A 40-site retailer wants guest and Microsoft 365 traffic offloaded locally at each branch, PCI traffic must stay on MPLS to the data center, and IT has no staff for branch firewalls. Which design trade-off should the engineer recommend for direct Internet access with security enforcement?
Select an answer to reveal the explanation.
Short Explanation
You're choosing between a local guard shack and a trusted patrol service. Offloading to the cloud keeps stores lean while staying protected, so centralization without backhaul is your sweet spot here.
Full Explanation
The recommended design correctly balances performance, compliance and operations by splitting traffic by policy: guest and Microsoft 365 break out locally via DIA to reduce MPLS load and latency while PCI remains pinned to MPLS toward the data center, and inspection is shifted to cloud-delivered security such as secure web gateway, CASB and DNS-layer protection so branches need no locally managed firewall. The branch-appliance design fails on operations because even with central management local next-generation firewalls still impose hardware lifecycle, high-availability, software upgrades, troubleshooting and RMA burden that the lean IT team cannot absorb across 40 sites. The design that also sends PCI over DIA fails on compliance and risk because placing regulated cardholder traffic on direct internet with only cloud inspection expands PCI scope, breaks the stated MPLS containment requirement and complicates audit segmentation. The design that backhauls Microsoft 365 over MPLS fails on performance and economics because tromboning latency-sensitive cloud traffic to a central stack congests expensive MPLS and defeats Microsoft local-egress guidance. As an exam caveat, remember that cloud-delivered security is not zero control, as identity, tunnel redundancy, forward-proxy policy and logging must still be designed, and as a practical check validate routing and segmentation with VRFs or policy-based routing plus path monitoring to prove guest and cloud traffic uses DIA, PCI stays on MPLS, and failover to cloud security remains resilient.