Your network contains an Active Directory forest.
The forest contains two domains.
You have a standalone root certification authority (CA).
On a serverin the child domain, you run the Add Roles Wizard and discover that the option to select an
enterprise CA is disabled.
You need to install an enterprise subordinate CA on theserver.
What should you use to log on to the new server?

A.
an account that is a member of the Certificate Publishers group in the child domain

B.
an account that is a member of the Certificate Publishers group in the forest root domain

C.
an account that is a member of the Schema Admins group in the forest root domain

D.
an account that is a member of the Enterprise Admins group in the forest root domain

Explanation:
Reference:
http://social.technet.microsoft.com/Forums/uk/winserversecurity/thread/887f4cec-12f6-4c15-a506-568ddb21d46b
In order to install Enterprise CA you MUST have Enterprise Admins permissions, because Configuration
naming context is replicated between domain controllers in the forest (not only current domain) and are writable
for Enterprise Admins (domain admins permissions are insufficient).