A healthcare group with 25 clinics wants only Salesforce and Workday to break out locally with NAT, while all other traffic stays on MPLS to headquarters. Engineers need per-application path and NAT control on WAN Edge routers. Which DIA control for selective application breakout should the engineer configure to meet NAT requirements?
Select an answer to reveal the explanation.
Short Explanation
You want a bouncer who only lets VIPs out the side door. A data-policy NAT-action matches just those two clouds and lets them exit locally.
Full Explanation
The correct approach works because a centralized data policy is defined centrally and enforced on WAN Edge routers, matching specific Salesforce and Workday application signatures with a NAT-enabled direct internet access action that translates private source addresses for local exit while leaving the default path for all other traffic over MPLS to headquarters, which satisfies per-application path selection, NAT control, selectivity, and scalable management for 25 clinics. The centralized policy without address translation fails by forwarding concept because permitting breakout without source NAT leaves private VPN addresses untranslated, so outbound sessions lack public reachability and return traffic cannot be routed correctly despite correct matching. The localized per-router policy with NAT fails by scope and orchestration concept because it can achieve the correct data-plane translation locally yet sacrifices centralized intent, requiring repetitive per-site configuration that increases operational overhead and drift across many clinics where central management was explicitly required. The centralized policy for all internet traffic with NAT fails by selectivity concept because it provides correct central control and translation but violates least-privilege breakout, sending unapproved traffic direct to the internet instead of retaining it on MPLS for security, compliance, and headquarters inspection. An exam caveat is to distinguish centralized data policy from control policy and localized policy, since only centralized data policy controls DIA forwarding and NAT behavior at scale while control policy governs overlay route advertisement. As a practical check, verify the DIA NAT pool and route on a WAN Edge, test Salesforce and Workday sessions for translated source and local egress, then confirm a generic web flow still traverses MPLS toward headquarters.