A retailer with 40 branches runs guest Internet in VPN 10 and a firewall service at DC site 100 advertising a service TLOC. The design requires guest prefixes to be reachable only through that firewall TLOC, with failover if it is withdrawn. Which control policy set action for service chaining should the engineer configure to steer traffic through the firewall TLOC?

The correct approach works because in SD-WAN service chaining the DC firewall advertises guest prefixes via OMP with a service TLOC, and a centralized control policy on SD-WAN Controller matching those VPN 10 prefixes with a set service action rewrites the route TLOC to that service TLOC, so all 40 branches resolve reachability only through the firewall with the route tied to the state of the advertised service, satisfying the steering requirement. The transport TLOC variant fails by concept because setting a next-hop transport TLOC pins forwarding to an underlay endpoint rather than consuming the service route, which ignores the service advertisement and its availability. The VPN 0 variant fails by concept because control policy service actions are VPN scoped and OMP tables are maintained per VPN, so steering in the transport VPN has no effect on VPN 10 guest routes which would continue to use local Internet exits uninspected. The branch-hosted variant fails by concept because the design requires central inspection at DC site 100 for scale and consistent policy, while sourcing the service TLOC from a branch violates the only-through-DC constraint and creates tromboning and inconsistent enforcement across sites. Exam caveat is to distinguish set service from set TLOC in control policy syntax, since the wording looks similar but only the service action follows service-route state for chaining. Practical check is to verify with show sdwan omp routes vpn 10 and show sdwan policy from-vsmart on a branch, confirm the TLOC points to the DC service address, then withdraw the firewall service and observe how the route changes.