A retail chain with 40 small stores needs backup connectivity for POS traffic when wired broadband fails, has limited IT staff, requires rapid deployment, and must maintain encrypted transport over the carrier network. Which WAN connectivity design using 4G/5G best meets the resiliency requirement?

The correct design is right because it keeps wired broadband as primary for normal POS traffic while adding a diverse cellular path that carries traffic only on failure, with a VPN overlay supplying encrypted transport over the carrier network and policy-based automatic failover that enables rapid template-driven deployment and central management for 40 sites with limited IT staff. Migrating all POS traffic to cellular with centralized management is a valid wireless-primary architecture but fails this scenario on resiliency role because it replaces rather than backs up the wired path, increasing carrier cost and everyday dependence on radio coverage. Having store staff enable the backup during outages can work in tiny shops but fails on automation and staffing because manual activation delays failover and risks inconsistent execution without on-site expertise, undermining rapid POS recovery. Using only a carrier private APN for isolated transport is widely deployed but fails on encryption concept because APN separation is isolation, not customer-controlled encrypted transport over the carrier access, which the requirement mandates via overlay VPN. An exam caveat is to distinguish separation from cryptographic confidentiality, as private APN and private networking are often conflated with encryption. A practical check is to simulate primary loss at a pilot store and verify fast VPN establishment, POS continuity, signal strength, data-plan sizing, and central alerting for failover events.