Your company has an Active Directory domain that has an organizational unit named Sales. The  Sales organizational unit contains two global security groups named sales managers and sales  executives.    
You need to apply desktop restrictions to the sales executives group.    
You must not apply these desktop restrictions to the sales managers group. 
You create a GPO  named DesktopLockdown and link it to the Sales organizational unit.    
What should you do next（）

Your company has an organizational unit named Production. The Production organizational unit  has a child organizational unit named R&D. You create a GPO named Software Deployment and  link it to the Production organizational unit.    
You create a shadow group for the R&D organizational unit. You need to deploy an application to  users in the Production organizational unit. You also need to ensure that the application is not  deployed to users in the R&D organizational unit.    
What are two possible ways to achieve this goal（）