A server that runs Windows Server 2003 acts as a stand-alone certification authority (CA). You create a local group named Key Recovery Team, and you add user accounts to the local group. You need to ensure that members of the Key Recovery Team group can recover archived private keys for users.

What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose two.)

A.
Assign the CA Administrator role to the Key Recovery Team group.

B.
Assign the Certificate Manager role to the Key Recovery Team group.

C.
Add the Key Recovery Team group to the local Administrators group on the CA.

D.
Add the Key Recovery Team group to the local Backup Operators group on the CA.