A retailer with 80 stores is evaluating Cisco SD-WAN to replace costly MPLS, payment data must stay encrypted across broadband, stores need basic Internet protection, and IT wants integrated threat functions without adding appliances. Which SD-WAN built-in security capability best addresses this distributed retail need?

The correct answer works because distributed retail replacing MPLS with broadband needs both transport confidentiality and branch edge protection without new hardware, and Cisco SD-WAN edge routers embed IPsec encryption for payment traffic together with stateful firewall, IPS signatures, and URL filtering in the same image, which directly satisfies encrypted broadband, basic Internet safety, and zero-appliance integration at scale for 80 sites. The IPsec with centralized key management approach is operationally sound for confidentiality and widely used to replace MPLS encryption, but it fails by concept because encryption alone does not inspect or filter hostile web content or intrusions, leaving Internet breakout unprotected. The integrated firewall with zone policies and NAT approach is also common for low-cost direct Internet access, yet it fails because without IPS and URL filtering it cannot stop application-layer threats or malicious web content, which the stem asks the platform to cover. The embedded encryption with separate virtual firewall and IPS appliances is a legitimate defense-in-depth design, but it fails the explicit no-extra-appliance constraint, reintroducing licensing, compute, patching, and site-visit overhead that integration is meant to eliminate. An exam caveat is to distinguish built-in edge capability from cloud-delivered or appliance-based security, since Cisco offers all three and only on-router integration meets all three needs here. A practical check is to validate the security license, encrypted throughput with all services enabled, and centralized SD-WAN Manager policy for firewall, IPS, and URL categories before migrating stores from MPLS.