Your network contains an Active Directory domain named contoso.com.
The domain contains a server named Server1 that runs Windows Server 2012.
Server1 is the enterprise root certification authority (CA) for contoso.com.
You need to enable CA role separation on Server1.
Which tool should you use?

A.
The Certutil command

B.
The Authorization Manager console

C.
The Certsrv command

D.
The Certificates snap-in

Explanation:
http://technet.microsoft.com/en-us/library/cc773161(v=ws.10).aspx
certutil -setreg ca\RoleSeparationEnabled 1