A large retail enterprise is deploying Cisco Secure Private Access to enable remote employees to...

Certificate Enrollment is the Cisco Secure Access ZTA enrollment method that supports registration without user interaction, satisfying the zero-touch requirement. SAML enrollment depends on an interactive identity-provider flow, so options B and D do not provide the required unattended experience. A VPN machine tunnel is a VPN connectivity model rather than the requested Secure Private Access ZTA enrollment approach. For back-end resiliency, private resources are reached through Resource Connectors. Cisco recommends deploying connectors in groups to provide scalability, load balancing, and redundancy; associating redundant Connector Groups with the resource avoids dependence on a single connector path. Option A is therefore the only choice that combines transparent certificate-based ZTA enrollment with resilient connector architecture. The other options either select the wrong enrollment mechanism, the wrong access model, or a single back-end connector. Cisco ZTA enrollment methods Cisco Connector Group guidance