A NOC team using SD-WAN Manager must triage a regional voice issue affecting three sites, needing to check device health, then tunnel loss and jitter, then confirm which applications consume bandwidth. The lead wants the fastest native workflow. Which monitoring dashboard sequence from the Manager answers this operational triage need?

The correct sequence aligns directly with the stated triage order and fastest native path in SD-WAN Manager because device health provides CPU, memory, temperature, power and interface state to rule out local system causes, tunnel statistics expose per-tunnel IPsec data-plane SLA including loss, latency and jitter needed to explain voice degradation across three sites, and the application-aware view with DPI aggregation confirms actual bandwidth consumers rather than assumed traffic. The QoS-policy variant fails by concept because policy configuration documents intended classification, queuing and marking but does not measure real-time utilization, so voice impact from a bulk transfer would remain unproven. The control-status variant fails by concept because control connections verify DTLS/TLS sessions to controllers and orchestrator for reachability and stability, not data-plane forwarding performance, thus loss and jitter remain invisible. The alarms-list variant fails by concept because the active alarms list summarizes discrete events and thresholds for rapid notification, not continuous health telemetry required to validate device status before transport analysis. As an exam caveat, distinguish monitoring dashboards from configuration and control-plane pages when wording emphasizes check, confirm consumption, or SLA, and as a practical check always scope all three dashboards to the same time window and affected sites then drill from site to device to tunnel to application to preserve causality.