You have an enterprise subordinate certification authority (CA).
You have a group named Group1.
You need to allow members of Group1 to publish new certificate revocation lists. Members of Group1 must not
be allowed to revoke certificates.
What should you do?

A.
Add Group1 to the local Administrators group.

B.
Add Group1 to the Certificate Publishers group.

C.
Assign the Manage CA permission to Group1.

D.
Assign the Issue and Manage Certificates permission to Group1.

Explanation:
Reference:
http://technet.microsoft.com/en-us/library/cc732590.aspx
Manage CA is a security permission belonging to the CA Administrator role. The CA Administrator can enable,
publish, or configure certificate revocation list(CRL) schedules.
Revoking certificates is an activity of the Certificate Manager role.