HOTSPOT
Your network contains one Active Directory domain.The domain contains an enterprise certification authority (CA).
You need to ensure that members of a group named Group1 can issue certificates for the User certificate
template only.
Which two tabs should you use to perform the configuration? To answer, select the appropriate tabs in the
answer area.
Hot Area:
Answer: 
Explanation:
To configure certificate manager restrictions for a CA
1. Open the Certification Authority snap-in, and right-click the name of the CA.
2. Click Properties, and then click the Security tab.
3. Verify that the user or group that you have selected has Issue and Manage Certificates permission. If
they do not yet have this permission, select the Allow check box, and then click Apply.
4. Click the Certificate Managers tab.
5. Click Restrict certificate managers, and verify that the name of the group or user is displayed.6. Under Certificate Templates, click Add, select the template for the certificates that you want this user or
group to manage, and then click OK. Repeat this step until you have selected all certificate templates that
you want to allow this certificate manager to manage.
7. Under Permissions, click Add, type the name of the client for whom you want the certificate manager to
manage the defined certificate types, and then click OK.
8. If you want to block the certificate manager from managing certificates for a specific user, computer, or
group, under Permissions, select this user, computer, or group, and clickDeny.
9. When you are finished configuring certificate manager restrictions, click OK or Apply.
Restrict Certificate Managers
https://technet.microsoft.com/en-us/library/cc753372.aspx