A bank is deploying controllers on premises across two data centers to survive loss of a full site and a single node, with 400 WAN Edges needing deterministic rehoming without manual reconfiguration. WAN Edges receive multiple addresses and must maintain control during failures. Which redundancy design ensures WAN Edges use multiple Validators and Controllers correctly?

The correct design works because distributing Validators and Controllers across both data centers removes single-site dependency and tolerates an additional node loss, a single Validator name resolving to all Validators ensures each of the 400 Edges learns multiple addresses without manual reconfiguration, and Controller groups with affinity maintain multiple concurrent sessions with defined preference so control persists through failures and rehoming is deterministic. The evenly load-balanced design without Controller groups preserves discovery and survivability but fails determinism because without preference order placement becomes opportunistic, leading to unpredictable homing, unnecessary moves and difficult capacity planning. The site-local Validator name design preserves affinity and control sessions but fails full-site survivability because Edges learn only local Validator addresses for locality, leaving no reachable orchestrator if the local site is lost. The single-pinned Controller design preserves discovery and affinity order but fails control continuity because keeping only one active session to save scale forces outage and re-establishment on every Controller failure instead of riding through on survivors. As an exam caveat, distinguish Validator discovery which provides addresses from Controller membership which sustains sessions, since DNS reachability alone does not maintain control. As a practical check, resolve the Validator name from both data centers, inspect control connections for expected group members, then isolate one site in maintenance to confirm sessions remain and Edges rehome to predicted survivors.