A bank NOC needs critical SD-WAN alarms in its Splunk collector and on-call mailbox with severity filtering, but engineers currently log into the GUI to spot outages and miss after-hours events. Audit requires centralized retention and no missed critical faults. Which alarm and forwarding design centralizes critical event visibility for this NOC workflow?

The correct design is right because it combines severity-based alarm rules on SD-WAN Manager with simultaneous northbound forwarding to both the on-call email list and a webhook receiver that feeds Splunk, so only critical faults are propagated automatically to both existing workflows, eliminating GUI polling and after-hours gaps while providing centralized retention for audit. The site-down-only design fails by scope because limiting forwarding to complete outages is operationally common for noise reduction but violates the no-missed-critical-faults mandate since certificate expiry, control-connection, hardware and other critical alarms would never reach the NOC. The GUI-acknowledgment design fails by workflow because requiring manual clearance before forwarding is standard for change control but reintroduces the exact GUI dependency and after-hours blindness the scenario must remove and delays email and webhook delivery. The local-only retention design fails by auditability because short local buffering is widely used for troubleshooting yet it does not provide centralized long-term retention in Splunk and the mail system for compliance proof. Exam caveat is to distinguish destination coverage from filter precision and retention location, as a design can list both receivers yet still be wrong on scope, timing or storage. Practical check is to generate a test critical alarm, confirm correlated arrival in Splunk with correct severity and in the mailbox, and verify retention policy and on-call notification without GUI login.