A logistics company wants hosts in service VPN 10 and service VPN 20 to be unable to talk to each other, while both VPNs keep their existing paths to Azure. Which policy enforces the split?
Select an answer to reveal the explanation.
Short Explanation
You can keep each service VPN’s path to Azure while closing the door between the two networks. A zone-based security policy denies traffic between VPN 10 and VPN 20. An Azure-focused SLA does not create that separation, and a SIG credential change does not remove inter-VPN routes from OMP.
Full Explanation
A zone-based security policy on Catalyst SD-WAN treats service VPNs as zones, so denying traffic between the VPN 10 zone and the VPN 20 zone stops east-west host traffic without withdrawing either VPN’s existing Azure routes. An application-aware routing SLA that prefers Azure selects a path for matched applications toward Azure; it does not define or enforce separation between the two VPNs. Cloud OnRamp for SaaS steers enabled SaaS applications, but enabling it does not block east-west traffic for every application. A SIG credential change affects connectivity to the secure internet gateway; it does not remove inter-VPN routes from OMP. If the routes themselves had to disappear, that would require control policy, but this requirement is to stop hosts from communicating while keeping their Azure paths. Exam caveat: OMP may still learn a route to the other VPN even though the zone-based policy drops packets, so do not expect the routing table to become empty. Practical check: a ping from a VPN 10 host to a VPN 20 host should fail with a zone-pair deny, while a ping from VPN 10 to Azure should still succeed.