An oil-field site has no DHCP, no internet, and no Plug and Play Connect reachability, but the engineer onsite can paste CLI via console to bring one WAN Edge online. The router has its certificate and root CA installed. Which manual bootstrap configuration versus ZTP distinction brings the isolated WAN Edge into the overlay?
Select an answer to reveal the explanation.
Short Explanation
You're giving directions by hand when GPS is down. Manual bootstrap supplies the minimum identity needed to call home.
Full Explanation
The correct manual bootstrap succeeds because an isolated WAN Edge with certificate and root CA installed still requires three non-discoverable values via console to build its first DTLS/TLS session when DHCP, DNS, internet and Plug and Play Connect are unavailable: organization name proves same-overlay membership, validator address provides explicit reachability for authentication and redirection to controllers, and system IP provides persistent overlay identity for control connections and OMP. The system-IP, site-ID, and organization-name approach without validator fails by reachability because with no discovery service the router has correct identity but no destination to initiate authentication. The validator, system-IP, and site-ID approach without organization name fails by trust because reachability alone cannot pass certificate validation when organization mismatch causes validator and controllers to reject the session. The organization-name, validator-address, and VPN-0-IP approach fails by identity because it substitutes underlay transport for overlay identity, and a transport or NAT address cannot replace the unique non-transport system IP required for control topology and OMP peering. For the exam, system IP is not an interface address or TLOC and is not assigned by the validator, which distinguishes manual CLI bootstrap from zero-touch provisioning. As a practical check, verify organization-name, vbond address, and system-ip in the minimal config and confirm control status shows validator reachability before letting certificate-authenticated DTLS orchestrate remaining controller and manager connections, remembering site ID plus reachable VPN 0 address and default route are also required but treated as given.