Your network contains an Active Directory domain named contoso.com.
The domain contains a server named Server1 that runs Windows Server 2016.
The hardware configuration on Server1 meets the requirements for Credential Guard.
You need to enable Credential Guard on Server. What should you do? Choose Two.

A.
Component to install: The Host Guardian Service server role

B.
Component to install: The Hyper-V server role

C.
Component to install: The VM Shielding Tools for Fabric Management feature

D.
Group Policy setting to configure: Access Credential Manager as a trusted provider

E.
Group Policy setting to configure: Network Security: Configure encryption types allowed for Kerberos

F.
Group Policy setting to configure: Turn on Virtualization Based Security

Explanation:
https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-requirements
The Virtualization-based security requires:
-64-bit CPU
-CPU virtualization extensions plus extended page tables
-Windows hypervisor
https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-manage#hardware-readiness-tool