A bank adds 60 new branches to its SD-WAN fabric with hubs in two data centers. Branch routes flap during maintenance and hub policies change weekly. Operations asks how routes and policy stay consistent without full mesh peering. Which description of the SD-WAN Controller role correctly explains control-plane distribution over OMP?

The correct description is accurate because SD-WAN Controllers maintain persistent OMP sessions to all WAN Edge routers and act as route reflectors, so branch prefixes are learned once and re-advertised without full-mesh peering, which contains flapping through centralized best-path selection and allows weekly hub policy to be distributed consistently to 60 branches. The IPsec tunnel description fails by plane because controllers never forward user packets; WAN Edge devices build IPsec tunnels using TLOCs learned via OMP and forward data directly, so it confuses control-plane learning with data-plane transport. The certificate description fails by role because authenticating devices and orchestrating initial onboarding belong to the Validator, while certificates come from the PKI or CA (the Manager can act as an enterprise CA), and none of that explains ongoing OMP advertisement or policy refresh. The template storage description fails by lifecycle because centralized templates, GUI management and long-term monitoring belong to the Manager plane, which provisions intent but does not peer via OMP or reflect routes. Exam caveat: questions often use renamed Controller, Validator and Manager titles interchangeably with vSmart, vBond and vManage, so focus on verbs like reflect, advertise and distribute to identify OMP control. Practical check: verify each edge shows OMP peering to both controllers, compare received routes and centralized policy versions, and confirm data tunnels follow the advertised TLOCs.