A service provider will grow to 2,000 WAN Edges across three regions and must survive loss of any single SD-WAN Controller without mass re-convergence, while keeping regional control traffic local where possible. Which control-plane scale and redundancy design with multiple controllers and groups meets regional resilience?

The correct design is right because multiple controllers provide horizontal scale for OMP sessions and control connections toward 2,000 edges, while controller affinity groups bind each region to an ordered preferred set that keeps steady-state messaging local for performance and isolation yet ensures every edge knows a reachable secondary, so loss of any single controller causes only localized failover rather than mass re-convergence. The globally load-balanced alternative fails on locality by concept because deliberately spreading sessions across all controllers maximizes cross-region control traffic and widens blast radius instead of containing it, even though balancing looks efficient. The manual-rehoming alternative fails on resilience by concept because requiring administrator intervention turns a survivable single failure into prolonged outage and coordinated reconvergence, violating the hitless redundancy goal. The local-only pinning without backup alternative fails on redundancy by concept because eliminating a secondary removes fault tolerance, so loss of the regional controller isolates that region despite achieving locality. Exam caveat is to distinguish affinity-based preference with automatic secondary failover from simple distribution or static pinning, and not to confuse control-plane affinity with data-plane load sharing. Practical check is to validate published per-controller edge scale, configure and document preferred versus secondary order per region, lab-test a controller shutdown to measure reconvergence and latency, and monitor control-connection counts per controller during rollout.