Your network contains an Active Directory domain named contoso.com.
The domain contains two sites named Site1 and Site2 and two domain controllers named DC1 and DC2.
Both domain controllers are located in Site1.
You install an additional domain controller named DC3 in Site1 and you ship DC3 to Site2.
A technician connects DC3 to Site2.
You discover that users in Site2 are authenticated by all three domain controllers.
You need to ensure that the users in Site2 are authenticated by DC1 or DC2 only if DC3 is unavailable.
What should you do?

A.
From Network Connections, modify the IP address of DC3.

B.
In Active Directory Sites and Services, modify the Query Policy of DC3.

C.
From Active Directory Sites and Services, move DC3.

D.
In Active Directory Users and Computers, configure the insDS-PrimaryComputer attribute for the users in Site2.

Explanation:
http://social.technet.microsoft.com/wiki/contents/articles/7573.active-directory-certificateservices-pki-keyarchival-andanagement.aspx#Protecting_Key_Recovery_Agent_Keys