A pharmaceutical maker runs 25 spokes and a headquarters hosting an IPS appliance behind a service-side attachment in a service VPN. Regulated research subnets must pass through the IPS, guest traffic must go direct, and routing must stay centralized. Which control-policy action inserts service chaining for the research prefixes through the IPS service?

The outbound Controller control policy with a service action toward the IPS for research prefixes is correct because it advertises the service-chain steering through OMP to the spokes, keeping routing centralized while limiting inspection to regulated traffic; guest traffic can remain direct. An inbound Controller control policy does not provide the needed advertisement to spokes: it governs routes received by the controller, rather than the routes it sends outward for devices to use. Applying the service action to both guest and research prefixes fails the traffic-selection requirement, because guest traffic would also be sent through the headquarters IPS instead of going direct. Setting a transport TLOC toward headquarters fails by mechanism: a transport TLOC identifies an overlay transport path, not the IPS service attachment, so it does not insert the IPS into the route. Exam caveat: distinguish service-action steering to a service TLOC from transport-TLOC selection; both can direct traffic toward headquarters, but only the service action chains the service. In practice, check that spokes learn research routes with the IPS service TLOC, verify research traffic appears in IPS logs, and confirm guest traffic exits directly.