A hospital has 40 clinics needing identical hub preference for telehealth centrally, but each clinic must translate its overlapping 10.1.0.0/16 LAN and enable local Internet breakout on site. Compliance requires central intent with per-site exceptions handled locally. Which statement correctly separates localized policy scope from centralized data policy enforcement scope?
Select an answer to reveal the explanation.
Short Explanation
Central decides the highway, local handles the driveways, and you spotted the split. Remember enforcement-point determines whether control is overlay-wide or device-specific.
Full Explanation
Centralized data policy is authored once in SD-WAN Manager, pushed through the SD-WAN Controllers and applied by site list, so it delivers identical telehealth path intent to all 40 clinics. Localized policy and the device templates for each clinic act only on that Edge: ACLs, QoS and route policy, plus the interface NAT that translates the overlapping 10.1.0.0/16 LAN before prefixes are advertised and the local Internet breakout. The option that has centralized policy performing site NAT fails because identical LANs must be translated on each Edge, not by a fabric-wide policy. The option giving per-clinic hub selection to localized policy fails because hub preference is the central intent, and local control would create drift and inconsistent failover. The option relying on centralized CLI templates for NAT, ACLs and redistribution fails because it blurs the scope split the question asks for: site-specific exceptions belong to Edge-local configuration, not to a central policy definition. Exam caveat: centralized policy is attached to site lists and applies fabric-wide, whereas localized policy is attached to a device template and affects only that device. Practical check: confirm the policy is activated in SD-WAN Manager, then on a clinic Edge verify NAT translations, hub routes and DIA counters after the push.