You work as an IT administrator in a large company, City Power and Light. The cpandl.com network consists of a single AD DS domain.

You are a member of a team designing a new in-house PKI for use with EFS. Your goals are to minimize the risk that the entire PKI will be compromised and to minimize the administrative overhead of publishing certificates. Which of the following CAs should you deploy for your PKI hierarchy? (Choose two. Each correct answer represents part of the solution.)

A. Offline root CA B. Online root CA C. Enterprise subordinate CA D. Stand-alone subordinate CA