A bank is adopting SD-WAN across branches and must ensure controller authentication, encrypted overlay traffic, and integrity validation even if underlay networks are untrusted. Which SD-WAN built-in security design provides control, data, and device protection together?
Select an answer to reveal the explanation.
Short Explanation
You're sending money over networks you don't own, so every layer must prove itself. Certificates plus encrypted control and data planes give you layered security from identity to packet integrity.
Full Explanation
The correct approach works because SD-WAN establishes device identity with certificates, protects controller and orchestrator exchanges with DTLS or TLS, and encrypts overlay data traffic with IPsec including encryption and integrity checks, together securing device, control, and data planes across untrusted transports. Application-aware routing with data policies fails by concept because routing and policy select paths and enforce forwarding behavior but do not provide authentication, encryption, or integrity on their own. SNMP monitoring with syslog collection fails by concept because visibility and logging detect events but cannot authenticate devices or encrypt and validate overlay packets. Overlay management protocol with route filtering fails by concept because OMP distributes routes and filtering controls advertisement, which supports control-plane reachability but not device authentication or payload encryption and integrity. For the exam, remember certificates anchor trust, DTLS/TLS secures control, and IPsec secures data; in practice verify certificate validity periods and confirm IPsec integrity counters increment across untrusted underlays.