Your network consists of an Active Directory forest that contains one domain named contoso.com. All domain controllers run Windows Server 2008 R2 and are configured as DNS servers. You have two Active Directory-integrated zones: contoso.com and nwtraders.com. You need to ensure a user is able to modify records in the contoso.com zone. You must prevent the user from modifying the SOA record in the nwtraders.com zone. What should you do?
A.
From the Active Directory Users and Computers console, run the Delegation of Control Wizard.
B.
From the Active Directory Users and Computers console, modify the permissions of the Domain Controllers organizational unit (OU).
C.
From the DNS Manager console, modify the permissions of the contoso.com zone.
D.
From the DNS Manager console, modify the permissions of the nwtraders.com zone.
can anyone explain to me why is not A
Delegation of control is for AD objects only and even though they are AD-integrated zones, you will need to use the the DNS console to manage the permissions in DNS.