Your network contains an Active Directory domain named contoso.com.
The domain contains a domain controller named DC1 that runs Windows Server 2012 R2.
On DC1, you open DNS Manager as shown in the exhibit. (Click the Exhibit button.)

You need to change the replication scope of the contoso.com zone.
What should you do before you change the replication scope?
Correct Answer: D
Explanation/Reference:
Explanation:
Lock icon signifies that the Zone has been signed. Changes to the zone are blocked when signed Note: Once a zone is signed for DNSSEC, the DNS server will explicitly block attempts to change the zone replication scope or zone type while the zone is signed. This is primarily to avoid complexities related to key storage.
References:
http://www.microsoft.com/en-us/download/dlx/ThankYou.aspx?id=29018