HOTSPOT
Your network contains an Active Directory domain named contoso.com.
Computer accounts for the marketing department are in an organizational unit (OU) named Departments
\Marketing\Computers. User accounts for the marketing department are in an OU named Departments
\Marketing\Users.
Marketing users can only log on to the client computers in the Departments\Marketing\Computers OU.
You need to App1y an Application control policy to all of the marketing users.
Which Group Policy Object (GPO) should you configure?
To answer, select the appropriate GPO in the answerarea.
Answer: 
Explanation:
I think it should be GPO4
I think so too
I think it should be GPO3. Since the policy setting is computer bound (Policy > Computer Configuration> Windows Settings > Security Settings > Application Control Policies
The part of the policy isn’t available in the user configuration.
Ok so here’s why it’s Computers (GPO3):
The question says that “Marketing users can only log on to the client computers in the Departments\marketing\computer OU.” But says you need an application control policy (which can only be applied to computers) to all of the marketing users. If the only computers the marketing users can use are the ones mentioned above, then it would only make sense to apply it directly to GPO3.
get it?
@ricky
Dont get it. On computers in marketing departament may work not only marketing users.
@adios. You can allow/deny users or a group from logging into the computer via the GPO. It’s a computer setting. To do so, you need to modify GPO3 in the example above (you can also modify GPO2 but this would make it more difficult to fix if something goes wrong). Reference: https://social.technet.microsoft.com/Forums/windowsserver/en-US/8b5b1134-6634-414d-a610-1cfa01c1b923/allow-only-certain-users-to-logon?forum=winserverGP