Exam 300-415 topic 1 question 355 discussion

It seems like B and D would be the correct answer. This question seems to test fundamental knowledge of pki, as well as sdwan experience. To use enterprise pki, the vmanage server needs to generate a certificate signing request (CSR) (B), send it to the root CA to get signed, and then upload that signed cert to vmanage (D). The other answers mentioning A and E here, are referring to the follow up step that the wan edges need to trust that signed cert from the new root CA, so the WAN edges need a copy of the root CA cert downloaded from the root CA server and then installed on the wan edge device. A and E are misleading because they seem to be referring to obtaining an identity or device cert manually and installing that. So... B and D IMO.

1 and 2 clearly states what to do to configure https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/sdwan-wan-edge-onboarding-deploy-guide-2020nov.pdf

To On-board a WAN edge using enterprise CA [which is the exact same lab setup by Keith B on CBTnug) You need to put a root cert on the edge, which you pull from the vmanage using the request file command. You then need to install it by using the request " request root-cert-chain install" https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/221605-install-root-certificate-on-sdwan-vedges.html

BD don't make sense to me . I think it's A and E

Enterprise - Mean you are using an Enterprise CA, not Default / Cloud I.E Cisco & DigiCert. Process for that is B,D.

I believe is BD https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-controller-cert-deploy-guide.html

In the picture it shows Enterprise not Manual. So, B and C eliminates. If Controller Certificate Authorization shows Enterprise I hope certificate from CA is already installed in vManage. So, D eliminates. Remains A and E.

B and D are correct