You have 10 domain controller in a domain.
You need to prevent several members of domain admin groups from logging on the domain controller.
Which two object should you create and configure?（）

Your network contains one Active Directory domain named contoso.com. The domain contains 10 domain controllers and a read-only domain controller (RODC) named RODC01.
You plan to deploy a child domain for contoso.com in Microsoft Azure.
To the Azure subscription, you add several virtual machines that have a Server Core installation of Windows Server 2012 R2.
You need to create the new domain on one of the virtual machines.
Which tool should you use?（）

Your network contains one Active Directory domain named contoso.com. The domain contains 10 domain controllers and a read-only domain controller (RODC) named RODC01.
The domain contains an administrator account named Admin1.
You need to prevent Admin1 from creating more than 100 objects in the domain partition.
Which tool should you use?（）

Your network contains an Active Directory domain named contoso.com. The domain contains a server named Server1. Server1 runs Windows Server 2012 R2.
You create a group Managed Service Account named gservice1.
You need to configure a service named Service1 to run as the gservice1 account.
How should you configure Service1?（）