An enterprise merges two regions and must stop one data-center prefix from spreading to a partner site while still advertising all other routes, with minimal side effects. The control policy is applied on the Controller. Which description correctly states control-policy direction and which routes the policy actually changes?
Select an answer to reveal the explanation.
Short Explanation
You're pruning a route announcement, not policing a download. Direction on the Controller decides which OMP view gets filtered. LAN policing and encryption happen elsewhere.
Full Explanation
The correct approach works because a centralized control policy on the Controller directly regulates OMP, the overlay routing control plane distributed to WAN Edge routers, using an inbound or outbound sequence that matches the target data-center prefix advertisement with reject while the default permits all other OMP routes, thereby surgically containing that one prefix from the partner site without collateral loss of reachability. The preference-steering approach fails because increasing OMP preference, TLOC preference, or origin only influences best-path selection for traffic engineering and still distributes the unwanted prefix, leaving it installed as a backup path. The TLOC-filtering approach fails because TLOC advertisements establish transport tunnel endpoints and encapsulation reachability, not data prefixes, so filtering them risks broad transport isolation and cannot cleanly withdraw one OMP data route while leaving other OMP routes intact. The WAN Edge BGP-filtering approach fails on enforcement point because edge-local BGP redistribution filtering may be operationally valid for mergers but is not Controller-based centralized control, violating the required central audit scope, scalability, and merger-management intent. Exam caveat: distinguish centralized control policy for OMP distribution, centralized data policy for forwarding and VPN topology, and localized routing policy for device-level BGP or OSPF interaction, since only the first applies inbound to routes received by the Controller or outbound from the Controller. Practical check: confirm sequence direction relative to the partner site and exact prefix-list and site-list matches, then verify with Controller OMP state and edge received OMP routes that the denied prefix is absent while other prefixes remain and permitted data-plane connectivity is unaffected.