Your network contains an Active Directory domain named contoso.com.
The domain contains two DNS servers that run Windows Server 2016.
The servers host two zones named contoso.com and admin.contoso.com.
You sign both zones.
You need to ensure that all client computers in the domain validate the zone records when they query the zone.
What should you deploy?

A.
a Microsoft Security Compliance Manager (SCM) policy

B.
a zone transfer policy

C.
a Name Resolution Policy Table (NRPT)

D.
a connection security rule

Explanation:
You should use Group Policy NRPT to for a DNS Client to perform DNSSEC validation of DNS zone records.