A multinational needs predictable, private-like connectivity from 40 branches to workloads in AWS and Azure VPCs/VNets without backhauling through its data centers. Security requires auto-provisioned IPsec to cloud gateways with OMP routing end to end. Which Cloud OnRamp for IaaS connectivity design meets this multicloud transit requirement?
Select an answer to reveal the explanation.
Short Explanation
You extend your fabric directly into both clouds instead of hairpinning traffic through your data centers. The cloud gateways provide automated IPsec and OMP-routed paths from branches into each VPC and VNet.
Full Explanation
The design that meets the requirement places Catalyst 8000V cloud gateways inside AWS VPCs and Azure VNets under SD-WAN Manager (formerly vManage) control. Manager automates IPsec tunnels from branches and extends the OMP overlay end to end, providing private-like, predictable paths without backhauling through data centers while preserving segmentation, policy, and visibility. Gateways using BGP to branches can support native cloud peering, but BGP does not meet the required OMP end to end: it strips SD-WAN attributes such as TLOC, preference, and origin, disrupting centralized control and seamless failover. Gateways deployed only in AWS can provide automated IPsec and OMP for a single-cloud expansion, but leave Azure VNets outside the multicloud transit design, requiring separate management and risking asymmetric routing. Gateways using OMP via data centers retain automation and OMP, but reintroduce backhaul, increasing latency and data-center load contrary to the direct branch-to-cloud requirement. An exam caveat is that the stated requirement is specifically for automated IaaS gateways and end-to-end OMP, not BGP routing or a data-center hub. In practice, check SD-WAN Manager for active cloud gateways, verify branch IPsec sessions, and confirm that OMP routes for both clouds arrive with the expected TLOCs before moving production traffic.