A logistics company wants every branch on one Catalyst SD-WAN overlay into AWS, with centralized policy and the public internet as the underlay. Which model matches that requirement?
Select an answer to reveal the explanation.
Short Explanation
You do not build a private highway, and you do not leave every branch as its own IPsec island. You put the branches on the SD-WAN overlay and let the internet carry it into AWS. Controllers and one policy are the point of that model.
Full Explanation
Catalyst SD-WAN internet-based cloud connectivity keeps the branches in one overlay. OMP and centralized policy decide how they reach AWS, and the underlay is the public internet toward a cloud gateway or the provider VPN integrated into that design. That is the model the logistics company described. Standalone native IPsec from each branch to a virtual private gateway can move packets, but it has no SD-WAN controllers and no shared overlay policy. It is the native IPsec model, which they did not ask for. An MPLS handoff into a Direct Connect transit virtual interface is private connectivity. The underlay is not the public internet. Direct internet access from PCs to public AWS API endpoints reaches SaaS-style public services, not the private VPC the overlay is meant to attach. Exam caveat: a design can mix an SD-WAN internet path with a private interconnect later. The requirement stated here is the internet overlay, so the private handoff is a different model. Operational check: branch edges should show control connections and BFD sessions toward the cloud TLOC, not a pile of unrelated crypto maps.