What ensures devices enroll securely with the SD-WAN manager during bootstrap?

• A. Certificate-based enrollment guided by vBond and vManage
• B. User password authentication only
• C. IPsec handshake without certificates
• D. MPLS labels

Answer: (A)

During bootstrap, establishing a trusted identity is essential, and that is achieved with certificate-based enrollment guided by the SD-WAN orchestrators. The device carries a bootstrap certificate or a trusted CA chain, and when it first powers up, it reaches out to vBond. vBond authenticates the device using its certificate, then directs the device to enroll with vManage, often exchanging or presenting certificates that vManage trusts. This TLS-based, mutual-authentication flow ensures only devices with valid, authorized certificates can enroll and receive configuration, policies, and overlay information.

Security hinges on identity verification via certificates rather than simple passwords, and it relies on the orchestration layer to approve and provision the device. In contrast, using password-only authentication lacks strong mutual trust; an IPsec handshake without certificates isn’t designed for initial enrollment, and MPLS labels have no role in the bootstrap enrollment process.