What should you do?

Domain.com has employed you as a network administrator. The Domain.com network consists of a single Active Directory domain named Domain.com. All servers on the Domain.com network run Windows Server 2008. Half the client computers run Windows XP Professional, and the rest run Windows Vista.
Domain.com contains a Windows Server 2008 Enterprise Root CA. A new Domain.com security policy prohibits port 443 and port 80 from being opened on the domain controllers as well as the giving any certificate authorizations. During the course of the week you receive an instruction from the CIO to ensure that all Domain.com users are able to have their certificates requested from the official Web interface. To accomplish this task you thus decide to install the AD CS role.
What should you do?

A.
Your subsequent step should be to configure the Online Responder Role Service on a member server.

B.
Your subsequent step should be to configure the Online Responder Role Service on a domain controller.

C.
Your subsequent step should be to ensure that the Certification Authority Web Enrollment Role Service is configured on a domain controller after the installation of the AD CS role.

D.
Your subsequent step should be to ensure that the Certification Authority Web Enrollment Role Service is configured on a member server after the installation of the AD CS role.