An enterprise has Guest VPN 10 at branches and MPLS VPN 20 toward the data center. A centralized data policy must handle internet-bound traffic leaving the Edge and tunnel-bound traffic arriving from the fabric differently, applied only to Site 30 and Site 40. Which direction and site-list application should the engineer configure to enforce correct data policy semantics?

Centralized data policy direction defines the inspection point, where from-service matches packets entering the Edge from the service side toward the overlay and from-tunnel matches packets exiting tunnels toward the service side, each assembled with site lists that scope which WAN Edges enforce the sequences. Using from-service for branch internet-bound flows and from-tunnel for returning or cross-site flows scoped to Site 30 and Site 40 satisfies different handling per direction while limiting blast radius. Reversing them fails the concept because the match would trigger on the wrong ingress interface, causing policies to miss or mis-steer traffic. Using only from-service for both directions fails because return traffic from the fabric would never be evaluated, breaking symmetric handling. Using only from-tunnel everywhere fails because it misses LAN-originated flows and violates least-scope by applying to all sites. For the exam, remember direction is about packet entry to the Edge logic, not geographic source, and in practice verify sequence counters per direction and confirm site-list membership before pushing.