An energy company must onboard 120 remote substations with limited local IT skills, strict certificate-based identity, and staged rollout by region. Templates should minimize per-site CLI. Which SD-WAN onboarding and provisioning approach best meets rapid secure deployment?
Select an answer to reveal the explanation.
Short Explanation
You've got 120 sites and no extra hands, so you'll want devices that phone home on their own — like new streaming sticks that set themselves up. You plug yours in, its factory certificate gets checked, and it pulls the perfect blueprint for your region.
Full Explanation
The correct zero-touch provisioning flow fits because factory-installed certificates anchored to Validator establish strict identity without site visits, while Manager templates with site-profile variables eliminate per-site CLI and allow controlled activation by region for 120 low-skill substations. The token-authenticated zero-touch variant fails on identity concept because one-time tokens or pre-shared keys prove possession of a bootstrap secret, not the required PKI-bound device identity validated against the root chain, so it cannot satisfy audit for certificate-based onboarding even though templating and regional variables look correct. The simultaneous bulk-activation variant fails on rollout control because pushing all sites at once removes phased validation, rollback scope, and regional maintenance windows, violating the staged-by-region requirement despite correct certificate and template mechanics. The manual local-CLI certificate variant fails on scale and skill concept because requiring technicians to enroll certificates per substation reintroduces travel, inconsistency, and CLI touch that templates were meant to remove, breaking rapid deployment with limited IT skills even though regional variables and Manager templates are used. For exams, distinguish authentication strength from automation convenience, as token ZTP and bulk ZTP are operationally valid elsewhere but wrong when strict certificates or staging are explicit. Practically, verify Validator trust, certificate serial allow-listing, template variables per region, and pilot one region before expanding.