A university streams lectures to three campuses, sources sit behind service VPNs, the overlay traverses the Internet, and RPT must avoid flooding all sites. Which multicast support approach should the engineer implement in the Cisco SD-WAN fabric?

The correct design works because lecture sources and receivers reside in service VPNs, so enabling PIM on service-side interfaces allows Edges to learn joins, maintain RPT shared-tree state, and map flows to the correct VPN, while overlay multicast with replicators carries that state across an Internet transport that cannot do native multicast and replicates only to Edges with downstream interest, preventing flood to all sites. Relying on native underlay multicast in the provider core fails on transport because it assumes end-to-end underlay multicast support, which does not exist over the public Internet, and that gap is exactly why overlay encapsulation and replicators are required. Placing PIM on transport-side TLOC interfaces fails on placement because TLOCs face the WAN and lack VPN-aware join state, so even with replicators configured the Edge cannot associate sources or receivers in the service VPN with the multicast control plane. Using PIM-SSM with IGMPv3 fails on tree type because SSM creates only source-specific shortest-path trees with no rendezvous point or shared tree, so it cannot meet an explicit RPT requirement despite being optimal for many one-to-many streams. For exams, remember Internet traversal signals overlay multicast, not underlay multicast or transport PIM. Practically, verify PIM neighbors and RP in the service VPN, confirm replicator roles and overlay multicast, then test a stream and check multicast routes and replication counters to prove only interested Edges receive it.