A hospital has dual hubs with separate TLOCs and needs MRI traffic from Clinic Site 20 to prefer the low-latency hub, remark voice to expedited forwarding, and drop guest traffic to the data center. The policy is centralized from the Controller. Which data policy action set should the engineer configure to enforce preferred path and QoS handling?
Select an answer to reveal the explanation.
Short Explanation
Your centralized policy is the traffic cop for forwarding decisions here. Steering plus marking plus permit or deny gives you path, priority and security in one stroke, and the set-actions do that work.
Full Explanation
The correct set matches centralized data policy enforced from the Controller for Clinic Site 20, where the set TLOC action (a remote TLOC, not the local-TLOC color selector) directs MRI toward the distinct TLOC of the low-latency hub to satisfy dual-hub path preference, set DSCP to expedited forwarding provides IP-layer remarking for voice that persists across routed WAN hops for end-to-end priority queuing, and accept versus drop in the same policy permits required clinical flows while blocking guest to the data center. The choice that forwards all clinic flows without drops preserves steering and remarking but violates the stated security requirement because guest traffic must be explicitly terminated, so permit-any forwarding would leave prohibited data-center access open. The choice that marks 802.1p CoS preserves steering and central accept-drop logic but fails QoS handling by concept because CoS lives only in the Layer 2 Ethernet header and is lost at WAN routing boundaries, so voice would egress without EF DSCP and miss expedited treatment. The choice that uses local routing policy on Clinic Site 20 can functionally steer, remark, and filter but fails the control-plane fact because the scenario requires Controller-centralized policy for consistent distribution and audit, while local configuration is unmanaged and inconsistent with overlay intent. As an exam caveat, separate centralized data policy forwarding and DSCP actions from control policy route advertisement, app-route SLA path selection, and VPN or next-hop constructs that do not enforce overlay TLOC preference. For a practical check, preview the centralized policy in SD-WAN Manager (formerly vManage) for correct site, direction, and matches, then verify preferred-hub egress, DSCP EF on voice captures, and drop counters for guest.