which would be taken offline if not issuing, renewing, …

Which of the following CA types would you deploy if you wanted to deploy a CA at the top of a
hierarchy that could issue signing certificates to other CAs and which would be taken offline if not
issuing, renewing, or revoking signing certificates?

A.
Enterprise root

B.
Enterprise subordinate

C.
Standalone root

D.
Standalone subordinate