HOTSPOT
Your network contains an Active Directory forest. The forest contains a single domain named
contoso.com.
AppLocker policies are enforced on all member servers.
You view the AppLocker policy applied to the member servers as shown in the exhibit. (Click the
Exhibit button.)
To answer, complete each statement according to the information presented in the exhibit. Each
correct selection is worth one point.
Answer: 
Explanation:
Isn’t the answer only local users can access internet explorer since domain users have an allow and a deny on the internet explorer. I thought the deny would take precedence
I’m going to assume that the members of Domain Admins are not also in Domain Users, so that Domain Admins can run iexplore.exe. I know that a new account goes in Domain Users by default, but normally a tech guy will have a normal account and an admin account. A company’s policy would probably be to remove the admin account from Domain Users so it doesn’t pick up policies that apply to real users, or get a mailbox etc. That would be a good practice.