You manage a SharePoint farm in an Active Directory Domain Services (AD DS) forest. You implement
SharePoint Online.
AD DS users must be able to access on-premises sites and SharePoint Online resources without having to
authenticate each time that they access SharePoint Online. You replace the default certificate for validating
incoming tokens in the SharePointfarm.
You need to ensure that SharePoint uses the new certificate.
Which service must you restart?

A.
Certificate Service

B.
Component Services

C.
Security Token Service

D.
SharePoint Timer Service

Explanation:
When you replace the Security Token Service (STS) certificate for a SharePoint 2013 farm you need to restart
IIS and the SharePoint timer service. Replace the STS certificate for the on-premises environment
https://technet.microsoft.com/en-us/library/dn551378.aspx