Thanks for the question. The acccess groups are actually created as the result of the Application Overlay wizard.
What DSM ships with is a set of 5 roles (corresponding to each access group). But you are correct we do NOT ship default access groups. Just run the wizard, as suggested in the exercise and you will see them created for you.