A bank is designing Cisco SD-WAN for 80 branches over public internet to carry cardholder data, requiring authenticated devices, encrypted transport, and isolated payment traffic from guest traffic. The board wants native overlay protections before adding perimeter firewalls. Which built-in SD-WAN security capability should the designer specify to satisfy these transport needs?

The correct choice specifies the native SD-WAN overlay triad needed for cardholder data over public internet: authenticated device identity ensures only authorized routers join the fabric, encrypted control connections protect routing and management, IPsec encrypts the data-plane overlay end to end, and VPN-based segmentation isolates payment traffic from guest traffic at every branch. The unified-VPN distractor fails by isolation concept because a common domain with shared policy may prioritize traffic but does not separate control or forwarding, so guest compromise or misconfiguration can reach payment systems and violate scope separation. The direct-internet-access distractor fails by confidentiality concept because VRF segmentation plus encrypted control does not protect payloads, leaving cardholder data exposed on public transport without IPsec integrity and encryption for the overlay. The centralized-egress-policy distractor fails by trust concept because strong overlay encryption plus segmentation without device authentication leaves onboarding unresolved, allowing rogue or spoofed routers to form adjacencies despite good transport controls. For exams distinguish native overlay protections from perimeter firewalls and control-plane TLS from data-plane IPsec, since inspection adds value but does not satisfy the asked built-in transport need. In practice verify certificate authority trust and revocation, confirm active IPsec associations with encrypt counters, and validate separate VRF tables with payment-to-guest denial tests before carrying live transactions.