HOTSPOT
Your network contains an Active Directory domain named contoso.com.
Computer accounts for the marketing department are in an organizational unit (OU) named
Departments\Marketing\Computers. User accounts for the marketing department are in an OU
named Departments\Marketing\Users.
Marketing users can only log on to the client computers in the Departments\Marketing\Computers
OU.
You need to apply an application control policy to all of the marketing users.
Which Group Policy Object (GPO) should you configure?
To answer, select the appropriate GPO in the answer area.
Answer: 
Explanation:
Application control policies specify which programs are allowed to run on the local computer and
which are not.
References:
http://technet.microsoft.com/en-us/library/hh125923(v=ws.10).aspx
http://technetHYPERLINK “http://technet.microsoft.com/enus/library/cc781458(v=WS.10).aspx#_blank”.HYPERLINK “http://technet.microsoft.com/enus/library/cc781458(v=WS.10).aspx#_blank”microsoftHYPERLINK “http://technet.microsoft.com/enus/library/cc781458(v=WS.10).aspx#_blank”.comHYPERLINK “http://technet.microsoft.com/enus/library/cc781458(v=WS.10).aspx#_blank”/en-us/library/cc781458(v=WSHYPERLINK
“http://technet.microsoft.com/en-us/library/cc781458(v=WS.10).aspx#_blank”.HYPERLINK
“http://technet.microsoft.com/en-us/library/cc781458(v=WS.10).aspx#_blank”10)HYPERLINK
“http://technet.microsoft.com/en-us/library/cc781458(v=WS.10).aspx#_blank”.HYPERLINK
“http://technet.microsoft.com/en-us/library/cc781458(v=WS.10).aspx#_blank”aspx
http://technetHYPERLINK “http://technet.microsoft.com/enus/library/hh967461.aspx#_blank”.HYPERLINK “http://technet.microsoft.com/enus/library/hh967461.aspx#_blank”microsoftHYPERLINK “http://technet.microsoft.com/enus/library/hh967461.aspx#_blank”.comHYPERLINK “http://technet.microsoft.com/enus/library/hh967461.aspx#_blank”/en-us/library/hh967461HYPERLINK
“http://technet.microsoft.com/en-us/library/hh967461.aspx#_blank”.HYPERLINK
“http://technet.microsoft.com/en-us/library/hh967461.aspx#_blank”aspx
http://technetHYPERLINK “http://technet.microsoft.com/enus/library/ee461050.aspx#_blank”.HYPERLINK “http://technet.microsoft.com/enus/library/ee461050.aspx#_blank”microsoftHYPERLINK “http://technet.microsoft.com/enus/library/ee461050.aspx#_blank”.comHYPERLINK “http://technet.microsoft.com/enus/library/ee461050.aspx#_blank”/en-us/library/ee461050HYPERLINK“http://technet.microsoft.com/en-us/library/ee461050.aspx#_blank”.HYPERLINK
“http://technet.microsoft.com/en-us/library/ee461050.aspx#_blank”aspx
http://technetHYPERLINK “http://technet.microsoft.com/enus/library/ee461044.aspx#_blank”.HYPERLINK “http://technet.microsoft.com/enus/library/ee461044.aspx#_blank”microsoftHYPERLINK “http://technet.microsoft.com/enus/library/ee461044.aspx#_blank”.comHYPERLINK “http://technet.microsoft.com/enus/library/ee461044.aspx#_blank”/en-us/library/ee461044HYPERLINK
“http://technet.microsoft.com/en-us/library/ee461044.aspx#_blank”.HYPERLINK
“http://technet.microsoft.com/en-us/library/ee461044.aspx#_blank”aspx
GPO3
GPO3 – Applocker can only be set on computer accounts.
My answer would be GPO4
its a tricky question, according to the question the answer should be GPO4, because its clearly asking about Marketing users, as shown
“You need to apply an application control policy to all of the marketing users.
Which Group Policy Object (GPO) should you configure?
To answer, select the appropriate GPO in the answer area”
GPO3 because “Marketing users can only log on to the client computers in the Departments\Marketing\Computers
OU.”
If you take a look at a GPO and expand computer and user configuration sections you will discover that there are no Application Control Policies available in the user configuration section only the older Software Restriction Policies. As the question states clearly You need to apply an application control policy to all of the marketing users and that Marketing users can only log on to the client computers in the Departments\Marketing\Computers OU.
IMO this would make the answer GPO3
good tutorial here https://www.youtube.com/watch?v=ab5IGQr70-g
It’s GPO3. You can only configure that policy into computers, the problem is you have to set a filter for the group and that can lead you into a mistake. IMHO