What should you do?

You work as an enterprise administrator at Domain.com. The Domain.com network consists of a single Active Directory domain named Domain.com. All servers on the Domain.com network run Windows Server 2008.
Domain.com contains a RODC (read-only domain controller) server named CERTKILLER-DC02 that resides in a remote location. A new Domain.com security policy requires that no passwords and encryption keys be stored on CERTKILLER-DC02. You need to make sure that the passwords and encryption keys cannot be stored on CERTKILLER-DC02.
What should you do?

A.
The best option is to set up RODC filtered attribute set on CERTKILLER-DC02.

B.
The best option is to set up RODC filtered set on the server that holds Schema Operations Master role.

C.
The best option is to set up forest functional level server for Windows server 2008 to configure filtered attribute set

D.
The best option is to delegate local administrative permissions for an RODC to any domain user without granting that user any user rights for the domain

E.
None of the above

Explanation:
You need to configure a filtered attribute set. This will ensure that the critical credentials are not replicated. You also need to then set up the RODC filtered set on the server that holds Schema Operations Master role. If you want to set up filtered attribute, you need to use forest functional level server for Windows server 2008. This will also allow you to use a Windows Server 2003 domain controller to replicate the attributes. However, if forest functional level server is Windows Server 2008 then an RODC that is compromised cannot be exploited in this manner because domain controllers that are running WindowsServer2003 are not allowed in the forest.
Reference : AD DS: Read-Only Domain Controllers / RODC filtered attribute set http://technet2.microsoft.com/windowsserver2008/en/library/ce82863f-9303-444f-9bb3- ecaf649bd3dd1033.mspx?mfr=true