A healthcare company needs secure Internet gateway access for two DC WAN Edges to a cloud security provider with frequent key rotation. Operations wants tunnels built and refreshed from SD-WAN Manager without manual IKE configuration on each router. Which SIG tunnel provisioning method should the engineer choose for automated creation?

Centralized SIG egress from two DC WAN Edges with frequent rotation and zero per-router IKE work requires automated SIG credentials because SD-WAN Manager uses the provider API to generate IPsec tunnels, distribute credentials, and automatically rekey and refresh them on schedule. The engineer-specified IKEv2 proposals approach fails by provisioning concept because administrator-defined transforms, DH groups, and authentication pushed via templates provide interoperability with a generic provider but retain IKE design and lifecycle work without hands-off generation and refresh. The provisioned IPsec for local Internet breakout approach fails by architecture scope because it enables distributed direct access with local inspection at branches, a valid branch design that does not provide centralized data-center-anchored egress and policy from the two DC edges. The persistent pre-shared keys approach fails by key-lifecycle concept because a stable key set once per site brings tunnels up reliably but avoids automatic rotation and cannot meet the frequent-rotation requirement. For the exam, do not equate any Manager-pushed tunnel with automated creation, since only credential-based integration performs provider-side creation and refresh; in practice verify both DC edges show active SIG tunnels, rekey counters increment on schedule, and centralized steering and failover succeed before migrating egress.