What should you recommend?

Your company, which is named Contoso, Ltd., has offices only in North America. The company has 2,000
users. The network contains an Active Directory domain named contoso.com.
You plan to deploy an Active Directory Certificate Services (AD CS) infrastructure and assign certificates
to all client computers.
You need to recommend a PKI solution to protect the private key of the root certification authority (CA)
from being accessed by external users.
What should you recommend? More than one answer choice may achieve the goal. Select the BEST
answer.A. An offline standalone root CA and an online enterprise issuing CA

B.
An online enterprise root CA and an online enterprise issuing CA

C.
An offline standalone root CA and an offline enterprise issuing CA

D.
An online enterprise root CA, an online enterprise policy CA, and an online enterprise issuing CA

Explanation:
http://technet.microsoft.com/en-us/library/cc737481(v=ws.10).aspx