Your network contains an Active Directory forest named contoso.com.
The forest functional level is Windows Server 2012. The forest contains a single domain. The domain contains
multiple Hyper-V hosts.
You plan to deploy guarded hosts.
You deploy a new server named Server22 to a workgroup.
You need to configure Server22 as a Host Guardian Service server.
What should you do before you initialize the Host Guardian Service on Server22?
A.
Install the Active Directory Domain Services server role on Server22.
B.
Join Server22 to the domain.
C.
Raise the forest functional level.
D.
Obtain a certificate.
Explanation:
https://docs.microsoft.com/en-us/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabricchoose-where-to-install-hgs
The only technical requirement for installing HGS in an existing forest is that it be added to the root domain;
non-root domains are not supported.