A manufacturer is bringing up a new fabric with an enterprise CA, and controllers plus 40 WAN Edges fail authentication because the root chain is missing. Installations must trust the same enterprise root on all devices before certificates validate. Which installation of the root certificate chain on controllers and WAN Edges establishes trust correctly?
Select an answer to reveal the explanation.
Short Explanation
You've got to give all your devices the same trust anchor before they'll talk, so you'll load the root bundle on Managers, Controllers, Validators, and WAN Edges first. It's like handing everyone the same signature book, so your device certs actually pass inspection.
Full Explanation
The correct enterprise root bundle installation establishes trust because a greenfield fabric using an enterprise CA has no pre-existing anchor, so pre-provisioning the same root on SD-WAN Manager, Controllers, Validators, and WAN Edges before loading identity certificates lets each device build the full chain for mutual TLS validation of control connections. The bootstrap-first device-certificates-then-root approach fails on sequencing because it attempts authentication before trust exists, ensuring chain failures; that order suits root rotation, not greenfield bring-up. The intermediate-only issuing CA approach fails on chain completeness because an intermediate cannot self-anchor validation when the root is absent, as when an offline root is kept protected, leaving Controllers and Validators unable to verify peers to a shared anchor. The per-site localized roots approach fails on consistency because different anchors per site fragment trust into isolated domains, valid for separate regional hierarchies but violating the requirement for one root trusted fabric-wide by controllers plus 40 WAN Edges. As an exam caveat, weigh anchor, scope, and timing together rather than choosing on a phrase like intermediate CA or phased deployment. As a practical check, verify identical root fingerprint and validity on Manager, Controllers, Validators, and a sample Edge before pushing device certificates, then confirm control connections form without chain errors.