You need to ensure that users from Group1 can modify the Security settings of OU1 only

Your network contains an Active Directory domain named contoso.com.
You log on to a domain controller by using an account named Admin1.Admin1 is a member
of the Domain Admins group.
You view the properties of a group named Group1 as shown in the exhibit. (Click the Exhibit button.)

Group1 is located in an organizational unit (OU) named OU1.
You need to ensure that users from Group1 can modify the Security settings of OU1 only.
What should you do from Active Directory Users and Computers?

A.
Right-click OU1 and select Delegate Control.

B.
Right-click contoso.com and select Delegate Control.

C.
Modify the Security settings of Group1.

D.
Modify the Managed By settings on OU1.

Explanation:
Delegating control to only the OU will allow the users of Group1 to modify the security settings.
References:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms676857(v=vs.85).aspx
http://technet.microsoft.com/en-us/library/cc732524.aspx