Which tool should you use?

Your network contains an Active Directory domain
named contoso.com. The domain contains a
server named Server1 that runs Windows Server
2012.
Server1 is the enterprise root certification
authority (CA) for contoso.com. You need to enable CA role separation on Server1.
Which tool should you use?

A.
The Certutil command

B.
The Authorization Manager console

C.
The Certsrv command

D.
The Certificates snap-in