A mining site has no Internet or DNS for ZTP, strict change control forbids Plug and Play Connect, and a field tech has a console cable plus a USB with certificates. The router must join controllers manually with verifiable bootstrap and minimal exposure. Which bootstrap method contrasts correctly with ZTP and Plug and Play Connect for this offline site?

The correct manual bootstrap fits this offline site because with no DNS, no Internet, and no cloud authorization allowed, all control parameters must be locally complete before connection, so literal Validator IPs provide reachability without resolution, the organization name enforces correct multi-tenant validation, and USB-installed certificates allow mutual authentication with minimal exposure and no external exchange. The FQDN-based manual approach is standard in many data centers for operational flexibility when controllers change addresses, but it fails on name-resolution concept because the site has no DNS to translate validators and the bootstrap would stall before control. The approach requiring one-time Internet for cloud Plug and Play approval is a legitimate and common deployment model for remote branches, but it fails on authorization and connectivity concept because change control forbids that service and the site is isolated, reintroducing the prohibited dependency. The approach that forms control first and enrolls certificates over TLS reflects SUDI-based auto-provisioning, but it fails on trust-sequencing concept because unauthenticated control violates verifiable bootstrap and discards the available USB trust material while widening exposure. As an exam caveat, separate automated discovery needing DHCP, DNS, or Internet from fully self-contained manual bootstrap and focus on IP versus name and when certificates are installed. As a practical check, confirm Validator IPs are reachable, organization strings match exactly, certificate validity and chain verify, and logs show authenticated control without cloud URL attempts.