A defense supplier must deploy SD-WAN Controllers on-premises with no Internet access to Cisco cloud services, using its internal PKI to issue all identities with short-lived certificates. Which certificate authorization approach should the engineer select for controller identity and onboarding?
Select an answer to reveal the explanation.
Short Explanation
You're running a private ID office with no outside help. Enterprise CA lets your own root vouch for every controller.
Full Explanation
Enterprise CA mode is correct because it anchors trust to the internal PKI root installed on controllers and edges, enabling fully offline on-premises onboarding without Cisco cloud reachability while supporting automated issuance and renewal of short-lived controller identities per policy. The enterprise variant that issues long-lived certificates is common to reduce operational overhead, but it violates the lifetime requirement by prolonging exposure after key compromise and failing compliance for short-lived identities. The cloud-root automated enrollment method is standard in Internet-connected deployments for scalable zero-touch provisioning with short validity, but it violates air-gap isolation by requiring Cisco-hosted trust and issuance that the scenario explicitly forbids. Manual installation of internally signed short-lived certificates preserves offline trust and validity and suits labs, but it breaks scalable lifecycle management because per-device upload without enterprise mode prevents consistent automated onboarding and renewal. For the exam, parse whether trust anchor, connectivity, validity, and automation each match the stem, since sound distractors alter only one element. Practically, verify the internal root is present on all nodes, confirm the template enforces short expiry with successful auto-renewal, and validate controller-edge control connections with cloud access blocked.