A bank must deploy SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator in a closed network with no internet access, using its internal PKI to issue all controller identities and requiring manual vetting of each device. Which certificate authorization option supports closed-network controller identity with enterprise PKI?

The correct configuration works because selecting enterprise root CA authorization makes SD-WAN Manager the controller PKI trust anchor, and installing the bank root chain on Manager, Controller, and Validator lets each controller obtain an enterprise-signed identity and mutually authenticate control connections with no Cisco cloud or internet dependency, preserving closed-network operation while keeping manual vetting workflow intact. The internet OCSP variant fails on transport dependency because even with correct enterprise issuance, requiring an internet-accessible responder for validation makes renewals and revocation checks unreachable in an isolated network and control-plane establishment will stall. The automatic-approval variant fails on authorization control because bulk auto-approving pending controller requests satisfies closed-network enterprise PKI operation but eliminates the required human review, allowing any correctly chained device to join without vetting. The manager-only trust variant fails on mutual authentication because TLS/DTLS between controllers needs bidirectional chain verification, so centralizing the root only on Manager leaves Controller and Validator unable to validate peers and peering fails. An exam caveat is to separate controller authorization scope from WAN edge authorization scope, since enterprise trust configured for edges does not confer controller identity. A practical check is to compare root fingerprints on all three controllers, enroll one test controller with manual approval, and confirm control connections establish with external OCSP disabled or redirected internally.