Which two roles and groups should you identify?

Your network contains an Active Directory forest named contoso.com. You have an Azure Directory (Azure AD) tenant named contoso.com.

You plan to configure synchronization by using the Express Settings installation option in Azure AD Connect.

You need to identify which roles and groups are required to perform the planned configurations. The solution must use the principle of least privilege.

Which two roles and groups should you identify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
A . the Domain Admins group in Active Directory
B . the Security administrator role in Azure AD
C . the Global administrator role in Azure AD
D . the User administrator role in Azure AD
E . the Enterprise Admins group in Active Directory

Answer: C E

Explanation:

References: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions