Your network contains an Active Directory domain named adatum.com. The domain contains a domain
controller named DC1 that runs Windows Server 2012 R2. On Dc1, you open DNS Manager as shown in the
exhibit. (Click the Exhibit button.)

You need to change the zone type of the contoso.com zone from an Active Directory-integrated zone to a
standard primary zone.
What should you do before you change the zone type?

A.
Unsign the zone.

B.
Modify the Zone Signing Key (ZSK).

C.
Modify the Key Signing Key (KSK).

D.
Change the Key Master.

Explanation:
A:
Lock icon indicating that it is currently signed with DNSSEC, zone must be unsigned.
B:
An authentication key that corresponds to a private key used to sign a zone.
C:
The KSK is an authentication key that corresponds to a private key used to sign one or moreother signing
keys for a given zone.
Typically, the private key corresponding to a KSK will sign a ZSK, which in turn has a corresponding private key
that will sign other zone data.

http://technet.microsoft.com/en-us/library/hh831411.aspx
http://technet.microsoft.com/en-us/library/ee649132(v=ws.10).aspx