Which service must you restart?

You manage a SharePoint farm in an Active Directory Domain Services (AD DS) forest. You
implement SharePoint Online.
AD DS users must be able to access on-premises sites and SharePoint Online resources without
having to authenticate each time that they access SharePoint Online. You replace the default
certificate for validating incoming tokens in the SharePointfarm.
You need to ensure that SharePoint uses the new certificate.
Which service must you restart?

A.
Certificate Service

B.
Component Services

C.
Security Token Service

D.
SharePoint Timer Service

Explanation:
When you replace the Security Token Service (STS) certificate for a SharePoint 2013 farm you need
to restart IIS and the SharePoint timer service.
Replace the STS certificate for the on-premises environment
https://technet.microsoft.com/en-us/library/dn551378.aspx