Your company has a main office and a branch office.The branch office contains a read-only domain controller
named RODC1.
You need to ensure that a user named Admin1 can install updates on RODC1. The solution must prevent
Admin1 from logging on to other domain controllers.
What should you do?

A.
Run ntdsutil.exe and use the Roles option.

B.
Run dsmgmt.exe and use the Local Roles option.

C.
From Active Directory Sites and Services, modify the NTDS Site Settings.

D.
From Active Directory Users and Computers, add the user to the Server Operators group.

Explanation:
Reference:
http://technet.microsoft.com/en-us/library/cc732301.aspx
Administrator Role Separation Configuration
This section provides procedures for creating a local administrator role for an RODC and for adding a user to
that role.
To configure Administrator Role Separation for an RODC
1. Click Start, click Run, type cmd, and then press ENTER.
2. At the command prompt, type dsmgmt.exe, and then press ENTER.
3. At the DSMGMT prompt, typelocal roles, and then press ENTER.
4. (…)