Your network contains an Active Directory forest named contoso.com. The forest contains an enterprise root certification authority (CA) on

a server that runs Windows Server 2016.

You plan to create and issue a custom subordinate CA template.

You need to prevent subordinate CAs from issuing subordinate certificates.

What should you configure in the template?

A. The Cryptography settings

B

. The Request Handling settings

C. The Basic Constraints extension

D. The Security settings