Which statement regarding domain local groups is correct?

• A. They can only have users from the same domain
• B. They can contain users from different domains
• C. They cannot be used outside of the user’s domain
• D. They are not available for global groups

Answer: (A)

Domain local groups are primarily designed to manage and assign permissions to resources within a specific domain. The correct statement highlights that these groups can only include users who are part of the same domain, which is a fundamental characteristic of domain local groups. This limitation allows for precise control over access to resources, ensuring that permissions are granted only to relevant users within the domain.

In contrast, the other statements are not accurate as they either misinterpret the design and purpose of domain local groups or pertain to different group types. For instance, the idea that domain local groups can contain users from different domains misunderstands their functionality, which is focused on internal domain management. Similarly, the assertion that they cannot be used outside the user's domain actually reflects their intended use within a specific domain for resource access. Lastly, the mention of their availability concerning global groups misrepresents how group scopes interact within the broader Active Directory framework.