A small branch has one Internet transport on GigabitEthernet1 with DHCP, needing local web breakout for VPN 10 users while corporate traffic stays on the overlay. Which DIA configuration best enables direct Internet access at the branch?
Select an answer to reveal the explanation.
Short Explanation
You're adding a local doggy door for web traffic. NAT on transport plus a service-VPN default points browsers straight out without touching overlay.
Full Explanation
Direct Internet access breaks out locally by enabling NAT on the transport-facing interface in VPN 0 to hide service-side sources, then installing a default static route in the service VPN such as VPN 10 whose next hop is VPN 0, leaving overlay routes for corporate prefixes intact. Placing the default in VPN 0 fails by concept because the transport VPN default governs underlay validation rather than providing the service-side breakout next-hop. Enabling NAT on the service interface toward OMP fails by concept because service-side NAT without transport NAT and interface next-hop does not exit to the ISP. Enabling IPsec toward VPN 512 fails by concept because management VPN and tunnel encryption do not create local NAT breakout for user traffic. Exam caveat: DIA needs interface NAT plus service default and outbound firewall policy, and practical check in SD-WAN Manager is to verify NAT interface statistics and VPN 10 route table shows the 0.0.0.0/0 via VPN 0.