A regional bank is upgrading 40 WAN Edge routers from SD-WAN Manager during a short maintenance window. The change plan requires automatic recovery if a router loses control connectivity after activation and proof that images were staged before reboot. Which software image management behavior should the engineer verify to meet the upgrade safeguard?

The correct behavior satisfies both safeguards because SD-WAN Manager first distributes and verifies the image on the WAN Edge routers, then reboots to activate, while an upgrade timer automatically restores the prior image if DTLS/TLS control connections to controllers cannot be re-established, preventing stranded routers during the 40-device window and proving staging before disruption. The workflow that stages and reboots but waits for manual approval fails by automation concept because it detects failure without self-remediation, leaving routers isolated until an engineer intervenes and violating the automatic recovery requirement. The workflow that installs on reboot with control-based rollback fails by sequencing concept because fetching the image during activation merges distribution with outage, eliminating prior proof of staging and increasing exposure to WAN transfer failure and extended downtime. The workflow that stages but rolls back on CPU and memory checks fails by trigger concept because resource health does not equal overlay reachability, so a router with normal utilization but version, certificate, or connectivity issues preventing controller join would never trigger recovery. The exam caveat is to distinguish control connectivity from BFD, OMP routes, or system health, since only lost manager and controller connectivity proves the device is unmanageable after activation. The practical check is to wait for distribution Complete before activation, confirm the rollback timer is enabled, then verify control connections, version, and retain staging logs as evidence.