A single-router branch with one MPLS and one internet transport must send guest VPN 20 traffic directly to the internet while corporate VPN 10 stays on the overlay. The internet interface needs NAT and the service VPN needs a local default route without leaking to OMP. Which direct Internet access configuration satisfies this branch isolation requirement?
Select an answer to reveal the explanation.
Short Explanation
You're keeping guest traffic out the side door while corporate stays on the overlay. That local NAT-enabled transport plus a VPN-scoped default route gives VPN 20 its own clean internet exit.
Full Explanation
Direct Internet access is realized by enabling NAT on the internet-facing transport VPN 0 interface to translate private service-VPN sources and by installing a 0.0.0.0/0 static route only in the guest service VPN that points to VPN 0 as next VPN, which keeps the exit local and prevents the default from entering OMP. Redistributing the MPLS default into OMP fails by concept because it would propagate a default across the overlay and pull other sites toward this branch, breaking isolation. Disabling NAT and advertising a data-center default over OMP fails because that design centralizes internet egress over the overlay, which denies the local breakout requirement and would need NAT at the hub instead. Enabling NAT service-side and allowing only control traffic fails because service-side NAT does not provide transport egress and control policy does not create forwarding or translation for data traffic. Exam caveat: remember NAT belongs on the transport interface and the static default must stay in the service VPN, and practical check is show ip nat translations and show ip routes in VPN 20 on the WAN Edge.