A retailer plans SD-WAN for 500 stores with dual transports per store, centralized policy, and no single failure taking down management or overlay establishment. Growth to 1000 sites is expected within two years. Which SD-WAN high availability and scale design should the architect propose to sustain resilient growth?

The correct design succeeds because it places redundant control and forwarding in separate failure domains across transports and sites while retaining centralized policy and modular headroom to grow from 500 to 1000 without redesign, preserving management and overlay establishment if any single element, site, or transport fails. The centralized resilient hub alternative is common and meets scale and policy goals but concentrates management in one location, so a site power, connectivity, or maintenance event can isolate controllers despite local redundancy, violating the no-single-failure requirement for management and overlay bring-up. The distributed autonomous-policy alternative improves survivability and uses both transports but replaces central intent with per-store autonomy, increasing drift, audit burden, and inconsistent enforcement and missing the centralized-policy mandate. The 500-site optimized alternative satisfies distribution and centralization today but provides no growth margin, forcing disruptive controller, licensing, or addressing changes before reaching 1000 sites. As an exam caveat, distinguish local redundancy from geographic and transport diversity, since two nodes in one rack do not create separate failure domains. As a practical check, validate vendor limits for devices, tunnels, and policies at 1000 sites plus headroom and test loss of one controller and one transport while confirming policy push and new tunnel formation.