A national logistics firm with 250 branches needs dual-transport SD-WAN with no single controller failure isolating sites and room to add 150 more sites without redesign. Which SD-WAN high availability and scale design meets dual-transport redundancy for these branches?

The correct design is right because it simultaneously satisfies device redundancy, control-plane survivability, transport diversity, and future scale: paired controllers avoid isolating branches on one failure, dual edge devices with two independent transports maintain forwarding when a link or node fails, distribution across failure domains removes geographic fate-sharing, and sizing beyond 250 accommodates 150 additional sites without redesign. The design optimized for efficient operation of the current 250 branches is architecturally sound for steady-state cost control but fails scalability because capacity, licensing, and control-plane sizing for present load alone will require redesign or forklift upgrade to reach 400 sites. The design relying on MPLS transport across failure domains with dual routers is a common high-capacity enterprise pattern but fails transport diversity because two devices sharing one underlay still fate-share on provider or backbone outages, losing the independent second path required for dual-transport redundancy. The design using a centralized regional controller cluster with dual-transport edges is operationally attractive for management simplicity but fails survivability because loss of that single domain suspends policy, keying, and new session establishment despite data-plane diversity and adequate 400-site sizing. As an exam caveat, do not conflate two boxes with two paths or a local cluster with geographic redundancy, as many stems test that distinction. As a practical check, verify published scale for 400 nodes, confirm diverse carriers per site, and test loss of an entire controller site while adding a branch.