Policy: Default Domain Security vs Default Domain Controller Security

How does precedence work for the Default Domain Controller Security Settings vs the Default Domain Security Settings
http://serverfault.com/questions/82923/how-does-precedence-work-for-the-default-domain-controller-security-vs-the-defaul

Useful comment:
It's worth noting that domain password policy is controlled by the resultant set of policy of all GPOs at the root of the domain, and not just the contents of the "Default Domain Policy". I don't ever modify the "Default Domain Policy" or "Default Domain Controllers Policy" in the field. I always create additional GPOs to override these settings, such that I can always disable my GPOs and return Active Directory back to "stock" behaviour if I need to.