Hotspot Question
Your network contains one Active Directory domain.
The domain contains an enterprise certification authority (CA).
You need to ensure that members of a group named Group1 can issue certificates for the User
certificate template only.
Which two tabs should you use to perform the configuration? To answer, select the appropriate
tabs in the answer area.
Answer: 
I doubt that answer, Question asks for providing the ability for Group1 to request a certificate on half of user for a certain certificate template which translate to Enrollment Agent as per that article below
https://technet.microsoft.com/en-us/library/cc754154(v=ws.11).aspx
Question asks for 2 tabs and you’ve only given one. Enroll is irrelevant to issuing a cert.