Your company has an Active Directory domain.
You plan to install the Active Directory Certificate Services (AD CS) server role on a member server that runs
Windows Server 2008 R2.
You need to ensure that members of the Account Operators group are able to issue smartcard credentials.
They should not be able to revoke certificates.
Which three actions should you perform? (Each correct answer presents part of the solution. Choose three.)

A.
Create an Enrollment Agent certificate.

B.
Create a Smartcard logon certificate.

C.
Restrict enrollment agents for the Smartcard logon certificate to the Account Operator group.

D.
Install the AD CS role and configure it as an Enterprise Root CA.

E.
Install the AD CS role and configure it as a Standalone CA.

F.
Restrict certificate managers for the Smartcard logon certificate to the Account Operator group.