You need to change the zone type of the contoso.com zone from an Active Directory-integrated zone to a standard primary zone

Your network contains an Active Directory domain named adatum.com. The domain contains a
domain controller named DC1 that runs Windows Server 2012 R2. On Dc1, you open DNS
Manager as shown in the exhibit. (Click the Exhibit button.)

You need to change the zone type of the contoso.com zone from an Active Directory-integrated
zone to a standard primary zone.
What should you do before you change the zone type?

A.
Unsign the zone.

B.
Modify the Zone Signing Key (ZSK).

C.
Modify the Key Signing Key (KSK).

D.
Change the Key Master.

Explanation:
A)
Lock icon indicating that it is currently signed with DNSSEC, zone must be unsignes
B)
An authentication key that corresponds to a private key used to sign a zone.
C)
The KSK is an authentication key that corresponds to a private key used to sign one or more
other signing keys for a given zone.
Typically, the private key corresponding to a KSK will sign a ZSK, which in turn has a corresponding
private key that will sign other zone data.
http://technet.microsoft.com/en-us/library/hh831411.aspx
http://technet.microsoft.com/en-us/library/ee649132(v=ws.10).aspx