What is the problem here? Users get a revocation warning while on the Internet, but not on the Intranet. So where is the revocation information? According to the question, it’s published to Active Directory. That explains why they can’t get there from the Internet, the company’s AD is not exposed to the Internet.

So we need to publish the revocation list to another location, one that the Internet-based clients CAN get to. A public-facing webserver for example.

We do this by adding that new location as a Certificate Revocation List (CRL) distribution point. Since the location(s) is/are stored in the certificate, we’ll need to re-issue.

So, as far as I’m concerned, the answer is D

C is right, because:
Certificate Enrollment Web Service
"allows users to obtain certificates using the HTTP
enables to connect to a CA through web services,
as a proxy for CA, and enables:
- to download root certificates
- request and install cert
- renew cert
- get revocation lists (CRLs)"