Your organization adopts an AD tiering model: Tier 0 (DCs, forest-level services), Tier 1 (member servers/apps), and Tier 2 (user workstations). You must prevent Tier 0 admin credentials from being exposed on Tier 1 and Tier 2 devices and ensure credential isolation between tiers. Which two actions align with the model?

The AD tiering model aims to protect high-privilege accounts. Issuing separate administrative accounts per tier and requiring Tier 0 admins to use only Tier 0 Privileged Access Workstations (PAWs) for DC administration directly supports credential isolation. This prevents Tier 0 credentials from ever touching lower-tier devices, thus mitigating "pass-the-hash" or "pass-the-ticket" attacks. Configuring GPOs on Tier 1 and Tier 2 to deny ‘log on locally’ and ‘access this computer from the network’ to Tier 0 admin groups further enforces this by preventing Tier 0 accounts from authenticating to lower-tier machines, even if compromised. Enabling unconstrained delegation on Tier 0 admin accounts is a security risk, as it allows the delegated service to impersonate the user to any other service, violating the principle of least privilege and increasing credential exposure. Adding Tier 0 admins to the local Administrators group on Tier 1 servers also exposes Tier 0 credentials to Tier 1 devices, undermining the tiering model. Enabling RDP Restricted Admin mode is for specific RDP scenarios but doesn't prevent Tier 0 credentials from being exposed if admins connect to any device, especially lower-tier ones, without proper isolation.