A bank is rolling SD-WAN to 300 branches with dual transports, needing controller survival during outages, deterministic failover for edge tunnels and a clear plan for device and site growth. The design must avoid single points of failure without oversubscribing control capacity. Which high availability, redundancy and scale approach fits?

The correct design fits because a Manager cluster plus redundant Controllers and Validators placed in separate sites eliminates geographic fate-sharing and preserves orchestration, device authentication and OMP policy during a regional outage, while dual edge devices on diverse transports keep BFD-monitored tunnels pre-established so failover is deterministic, and the distributed control components can be sized with headroom for 300 branches without oversubscribing control connections. Pairing the Validators only at headquarters fails on control-plane resilience because local pairing protects against box failure but not site loss, leaving device authentication and orchestration as a geographic single point of failure in the very outage the design must survive. Relying on on-demand tunnels fails on determinism because tunnels built only when traffic flows add signaling and setup delay at failover, whereas deterministic failover needs standby paths already up and monitored. Sizing control components to current load fails on scale engineering because it removes growth headroom and risks oversubscribing control connections as devices and sites are added. As an exam caveat, in Catalyst SD-WAN the SD-WAN Manager is the component that forms a cluster, while Controllers and Validators gain redundancy by deploying multiple instances, so read for failure domains rather than the word cluster. As a practical check, map Manager nodes, Controllers, Validators, edge pairs and transports to sites, confirm every edge can reach more than one Controller and Validator, and compare rated control-connection capacity against projected growth with spare margin.