A 40-site retailer needs direct Internet access for guest Wi-Fi and Microsoft 365, must keep PCI card data on the VPN overlay, and has small branches with no local security staff. Which DIA security enforcement design best balances these DIA trade-off requirements?
Select an answer to reveal the explanation.
Short Explanation
You get the best of both worlds with that split approach for your stores. Branch DIA is like a local exit ramp, while cloud security is your toll patrol. It preserves segmentation by keeping PCI on the overlay and offloads heavy inspection.
Full Explanation
The correct design succeeds because it differentiates traffic by trust and regulatory impact, permitting trusted SaaS such as Microsoft 365 to use local direct Internet access for optimal latency, retaining PCI card data strictly on the VPN overlay for segmentation and centralized control, and steering untrusted web browsing to cloud-delivered security for content filtering and threat prevention without onsite management, which directly addresses small branches with no security staff. The hub-inspection design is operationally strong for uniform policy and data loss prevention but fails the performance requirement by carrying Microsoft 365 over VPN to the hub, reintroducing backhaul latency and hub capacity pressure that direct access is intended to eliminate. The branch-tuned firewall design correctly separates guest Wi-Fi, SaaS, and PCI transport but fails the staffing constraint because effective local inspection depends on continuous onsite tuning, upgrades, and incident handling that these sites cannot sustain. The segmentation with direct PCI breakout design efficiently offloads the VPN and leverages cloud inspection, yet it fails the compliance requirement by removing card data from the protected overlay, thereby expanding PCI scope and audit burden. As an exam caveat, prioritize explicit must-keep and must-break-out statements over generally best practices when trade-offs conflict. As a practical check, confirm SD-WAN business-intent policies, path measurements for Microsoft 365, VPN containment proof for PCI, and centralized cloud security logging before cutover.