A hospital prioritizes Epic traffic from 10.10.0.0/16 to its data center 172.16.5.0/24. The centralized application-aware routing policy must match the source prefix, destination prefix, approved application, and voice DSCP before setting the SLA path. Which sequence match set should the engineer configure to enforce that precise classification?

The precise classification required here demands one centralized application-aware routing policy sequence that simultaneously matches the 10.10.0.0/16 source prefix, the 172.16.5.0/24 destination prefix, the approved Epic application, and the voice DSCP value before setting the SLA path, which ensures only qualifying hospital traffic is steered while other flows between the same endpoints remain under normal routing. The sequence matching only addresses and DSCP without application fails by concept because address plus marking is overly broad for application-aware steering and would incorrectly prioritize any voice-marked traffic between those prefixes rather than Epic specifically. The sequence using destination port instead of destination prefix fails by concept because a port identifies a service rather than topology and therefore cannot confine the policy to the data-center subnet, risking both missed Epic sessions and unintended matches elsewhere. The sequence using TCP port instead of DSCP fails by concept because ports cannot verify per-hop marking or media treatment, so bulk Epic data could be steered as voice while dynamic-port voice could be missed. An exam caveat is that policy match names look very similar under time pressure, so explicitly map each stem requirement to source, destination, application, and marking before choosing a familiar combination. As a practical check, validate in SD-WAN Manager with policy preview and hit counters plus DPI confirmation that test Epic voice increments all match conditions together and that removing any single condition prevents the SLA action.