A regional retailer runs dual SD-WAN Controllers for two VPNs and must stop Site 20 prefixes from being advertised to Site 30 while keeping both sites reachable from headquarters. The engineer will use a centralized policy that filters OMP route advertisements. Which control policy direction on the SD-WAN Controller achieves the route-filtering requirement?

Centralized control policy acts on OMP on the controller, where inbound controls what the controller accepts into its RIB from edges and outbound controls what it advertises to selected sites, so an outbound policy toward Site 30 that matches Site 20 prefixes suppresses only the prohibited advertisement while preserving those routes on the controller for headquarters to learn and reach both sites across both VPNs. The inbound filtering choice fails by route-propagation concept because denying Site 20 at ingress clears it from the controller database, so headquarters loses reachability even though Site 30 is also protected. The reversed outbound choice fails by directionality concept because it withholds Site 30 prefixes from Site 20, solving the opposite isolation case while leaving Site 20 to Site 30 advertisements intact. The overbroad outbound choice fails by scope concept because denying Site 20 prefixes toward both Site 30 and headquarters enforces strict segmentation but violates the explicit requirement to keep headquarters connected to both sites. For exam precision, always interpret inbound and outbound from the controller viewpoint and verify site-list, prefix-list, and VPN membership rather than assuming all sites share fate. For practical validation, preview the policy effect on the controller, confirm Site 20 routes remain in the controller OMP RIB and on headquarters, then confirm Site 30 no longer receives them while headquarters can still ping both sites.