A manufacturing campus runs SD-Access fabric for wired policy and must add Wi-Fi in warehouses with roaming handled by the existing controllers, fabric policy for corporate SSIDs, and minimal new WLC integration work. Which wireless integration choice balances over-the-top versus fabric wireless trade-offs for this campus?

The hybrid design is correct because SD-Access fabric wireless embeds SGT and policy directly for corporate users while over-the-top deployment keeps warehouse roaming on the existing controllers' CAPWAP mobility for forklifts and scanners, thus meeting policy, autonomous roaming, and low integration effort together. The centralized OTT design with VLANs and ACLs preserves proven WLC mobility and avoids fabric integration, yet it replaces scalable group-based policy with manual segmentation that does not extend fabric roles to wireless corporate clients. The fully fabric-integrated WLC design correctly extends SGT everywhere and supports seamless Layer 2 and Layer 3 roaming, yet it demands Catalyst Center host-tracking, control-plane and fabric edge configuration in every warehouse, contradicting minimal new integration work. The fabric-everywhere tunneled design maintains consistent SGT enforcement by anchoring warehouse clients to central edges, yet backhauling departs from the roaming model the warehouses use today and adds latency and resiliency risk for real-time warehouse applications. For exams, remember trade-off questions test selective fit rather than strongest security, so do not choose uniform policy when the stem explicitly constrains effort or mobility mode. In practice, verify SSID to fabric mapping in Catalyst Center, confirm warehouse AP mobility behavior with a roaming walk test, and validate SGT propagation with a policy matrix check before rollout.