A SAN with a CS vServer is the answer, as you have 3 different URL with .com/.org/.net. Wildcards are firstly not really recommended but aren't used for org indicators at the end of the URL. So a Wildcard just wont work... D is incorrect flatly due to its inability to be used. B works but, typically if we got 3 URLs resolving via to the same IP it is more ideal to use a CS vServer so we have granular control over the urls individually, a single SSL Offload vServer would make it where the 3 are bound together as a service so a change will always impact all 3 unlike a CS vServer connecting to non-addressable LBs. The question is flawed unfortunately and cannot be answered properly.

Best practice would be a SAN, imo

B is correct

A is correct https://support.citrix.com/article/CTX205283#:~:text=You%20can%20enable%20the%20SNI,certificates%20to%20the%20virtual%20server.

B is right answer. https://knowledge.digicert.com/solution/SO9440.html

A is right answer

Both A and B are correct. You can have 3 different certificate bind to same Virtual server or you can go for SNI option . More correct answer is A , because he is already has certificate with him

Both A and B are correct. You can have 3 different certificate bind to same Virtual server or you can go for SNI option

I believe the answer should be A, the websites already exist and likely the certs, it's just a single vServer that needs creating and therefore by enabling the SNI and ticking the box when binding the cert, multiple certs can be assigned to a single vServer; https://www.citrix.com/blogs/2015/09/10/citrix-netscaler-how-to-apply-multiple-certificates-to-one-virtual-server/

B. SAN should cover all three names and domain extensions. Wildcard can only cover domain names

I think right one in use SAN. wildcard certificate apply on prefix. *.aa.com is ok www.aa.* not