A healthcare company must onboard SD-WAN Controllers and 80 WAN Edges with strict audit rules: production controllers need automated scalable trust, while a isolated lab needs temporary bring-up without external PKI. Security approved Cisco cloud PKI for production and manual install for lab. Which certificate authorization plan satisfies both environments for this deployment?
Select an answer to reveal the explanation.
Short Explanation
You're juggling audited production and a quick lab, so one trust model won't fit both. Cisco-signed automation scales production securely while manual install keeps the lab isolated and simple.
Full Explanation
The correct plan satisfies both constraints because Cisco cloud automated enrollment provides scalable, auditable trust for production controllers and all 80 WAN Edges without per-device manual handling, while manual installation gives the isolated lab temporary bring-up with no dependency on external PKI or internet reachability, exactly matching security approval. An enterprise root CA design for production controllers and Edges is operationally sound in many enterprises and simplifies internal trust, yet it fails here on authorization concept because security explicitly approved Cisco cloud PKI for production, so audit would flag an unauthorized trust anchor. A mixed design that keeps automation for controllers and lab but puts manual certificates on the 80 production Edges is common for small pilots, yet it fails here on scalability concept because manual issuance and renewal for dozens of production routers creates operational burden and violates the automated scalable trust requirement. Extending automated enrollment to controllers, Edges, and lab devices for consistent audit trust is attractive for uniformity, yet it fails here on isolation concept because the lab must operate without external PKI, and automated enrollment would require unwanted connectivity and permanent trust. Exam caveat is to prioritize explicit approval, scale, and isolation cues over generic assumptions about enterprise CA superiority or consistency. Practical check is to verify certificate authorization settings in the controller template, confirm production devices show Cisco-signed validity, and confirm lab devices use manually installed certificates with control connections established only where intended.