What should you do first?

A company has an Active Directory forest.
You plan to install an offline Enterprise root certification authority (CA) on a server named CA1.
CA1 is a member of the PerimeterNetwork workgroup and is attached to a hardware security module for private key storage.
You attempt to add the Active Directory Certificate Services (AD CS) server role to CA1.
The Enterprise CA option is not available.
You need to install the AD CS server role as an Enterprise CA on CA1.
What should you do first?
A. Add the DNS Server server role to CA1.
B. Add the Web Server (IIS) server role and the AD CS server role to CA1.
C. Add the Active Directory Lightweight Directory Services (AD LDS) server role to CA1.
D. Join CA1 to the domain.