A NOC manages 150 WAN Edges from SD-WAN Manager and must forward critical tunnel-down and certificate alarms to Splunk via webhook and to PagerDuty via email, while avoiding alert storms during ISP flaps. Which alarm and notification configuration meets centralized monitoring and dampening needs?

Centralized SD-WAN Manager configuration is essential for 150 WAN Edges: it provides consistent, single-point severity control, dual-channel forwarding, and dampening rather than scattered device-CLI management. Severity rules isolate critical tunnel-down and certificate alarms from lower-priority noise; webhook notifications send Splunk structured data for long-term correlation, email recipients provide PagerDuty with actionable escalation, and per-minute notification thresholds limit repeated alerts during ISP flaps. Immediate delivery of every critical alarm keeps both channels active but lacks dampening, so a flap can flood SIEM ingestion and on-call inboxes with duplicate tunnel-down messages. Webhook notifications without email and with per-minute thresholds provide centralized analytics and dampening, but leave PagerDuty blind and fail the required parallel webhook and email delivery. Configuring severity rules, email, and webhook with throttling on each WAN Edge provides the needed functions locally, but risks configuration drift, inconsistent thresholds, and unscalable touch-per-router work. Exam caveat: distinguish Manager alarms and notifications with throttling from SNMP polling, debug logging, or audit exports; only the alarm-and-notification configuration provides severity-based dual forwarding with dampening. Practical check: simulate a tunnel flap in a lab and verify that Splunk receives throttled webhook posts while PagerDuty receives limited emails per interval.