You have an Active Directory domain that contains several Hyper-V hosts that run Windows Server 2016.
You plan to deploy network virtualization and to centrally manage Datacenter Firewall policies.
Which component must you install for the planned deployment?

A.
the Routing role service

B.
the Canary Network Diagnostics feature

C.
the Network Controller server role

D.
the Data Center Bridging feature

Explanation:
Using Windows PowerShell, the REST API, or a management application, you can use Network Controller to
manage the following physical and virtual network infrastructure:
* Datacenter Firewall
This Network Controller feature allows you to configure and manage allow/deny firewall Access Control rules for
your workload VMs for both East/West and North/South network traffic in your datacenter. The firewall rules are
plumbed in the vSwitch port of workload VMs, and so they are distributed across your workload in the
datacenter. Using the Northbound API, you can define the firewall rules for both incoming and outgoing traffic
from the workload VM. You can also configure each firewall rule to log the traffic that was allowed or denied by
the rule.
* Hyper-V VMs and virtual switches
* Remote Access Service (RAS) Multitenant Gateways, Virtual Gateways, and gateway pools
* Load Balancers
https://technet.microsoft.com/en-us/library/dn859239.aspx