Your company has a single Active Directory Domain Services (AD DS) domain named contoso.com that uses
Active Directory integrated DNS.
You deploy the Key Management Service (KMS) on a Windows 7 computer.
You need to ensure that Windows 7 client computers can locate the KMS host and perform activation.
Which two actions should you perform? (Each correctanswer presents part of the solution. Choose two.)

A.
Create and deploy a GPO firewall rule to allow RPC traffic through TCP port 1688 on the client computers.

B.
Deploy a Windows Server 2008 KMS host.

C.
Grant the KMS server the Full Control permission on the _vlmcs._tcp.contoso.com DNS record.

D.
Grant the KMS server the Full Control permission on the _msdcs._tcp.contoso.com DNS zone.

Explanation:
The KMS clients find the KMS host via a DNS SRV record (_vlmcs._tcp) and then automatically attempt to
discover and use this service to activate themselves. When in the 30 day Out of Box grace period, theywill try
to activate every 2 hours. Once activated, the KMS clients will attempt a renewal every 7 days.
Listening on Port
Communication with KMS is via anonymous RPC. 1688 is the default TCP port used by the clients to connect to
the KMS host. Make sure this port is open between your KMS clients and the KMS host.
http://technet.microsoft.com/en-us/library/ee939272.aspx