An insurer must divert guest traffic to a scrubbing firewall, preserve voice markings end to end, and drop known malicious prefixes at the edge branches with dual transports. The policy team must encode forwarding and marking in one centralized data policy. Which data policy action set correctly uses set local TLOC, next hop, VPN, DSCP, and drop or accept for this control?

The correct set matches centralized data policy forwarding because preferred local TLOC controls egress across dual transports, service next hop provides firewall service insertion for guest scrubbing, target VPN enforces segmentation, DSCP remarking preserves voice markings end to end, and accept or drop supplies filtering for known malicious prefixes in one sequence. The alternative that uses local TLOC with firewall next hop and target VPN plus accept or drop is a sound steering and segmentation design but fails by omitting DSCP handling, so voice QoS cannot be guaranteed end to end despite correct path and security. The alternative that uses local TLOC toward direct transport with target VPN plus DSCP remarking and accept or drop preserves segmentation, marking, and filtering yet fails by omitting service insertion, so guest traffic bypasses mandatory scrubbing. The alternative that uses local TLOC with service next hop in the source VPN plus DSCP remarking and accept or drop preserves path, inspection, marking, and filtering yet fails by omitting target VPN redirection, so guest isolation is broken. For exams remember centralized data policy is the only place where TLOC, next-hop service, VPN, DSCP, and accept-drop forwarding actions combine, unlike control or app-aware routing policies. Practically confirm with policy preview and show sdwan policy counters plus captures checking egress interface, firewall hop, VPN ID, DSCP values, and drop counters for malicious test prefixes.