A hospital network team is designing SD-Access underlay for a new campus with limited routing expertise, a greenfield IP transport need, and a desire for fast automated bring-up managed from the controller. The core must still allow custom MTU and protocols if needed later. Which underlay choice balances automation with future flexibility?

The correct design is right because SD-Access LAN automation builds a greenfield IS-IS routed underlay with zero-touch plug-and-play from Catalyst Center, which directly addresses limited routing expertise and the demand for fast controller-managed bring-up while the discovered fabric remains a standard routed IP network that can later be tuned for MTU, BFD, timers or added protocols, thus balancing automation with future flexibility. The manually built OSPF approach fails by operations concept because while expert CLI tuning delivers full control over MTU and BFD, it requires deep routing skill, slows onboarding, increases inconsistency risk, and bypasses controller orchestration contrary to the stated speed and simplicity goals. The locked-defaults LAN-automated fabric fails by extensibility concept because it preserves automation but explicitly prohibits post-install tuning, violating the core requirement to retain custom MTU and protocol evolution. The provider MPLS reuse fails by scope concept because while carrier transport can accelerate connectivity and scale, it substitutes an external brownfield WAN for the required greenfield campus IP transport and does not provide the LAN-automated IS-IS underlay SD-Access expects. Exam caveat: distinguish underlay transport from VXLAN-LISP overlay policy, since questions often test whether automation applies to physical reachability versus virtual segmentation. Practical check: after automation, verify end-to-end MTU with extended ping, confirm IS-IS adjacency and loopback reachability in Catalyst Center, then document any planned BFD or jumbo-frame change window before production.