A hospital wants Catalyst SD-WAN to inspect branch internet traffic for exploits and block matching flows. Path selection is already correct. Which policy does the inspection?
Select an answer to reveal the explanation.
Short Explanation
Choosing a smooth road does not open the crates. You put intrusion prevention on the security policy for the zone pair that faces the internet. An OMP preference only picks a path, and a jitter SLA does not look for exploits.
Full Explanation
Intrusion prevention on Catalyst SD-WAN is a security-policy feature applied to a zone pair. Internet-bound branch traffic crosses the zone pair that faces the internet exit or the SIG, and that is where exploit signatures can block a matching flow. Path selection is already correct, so a control policy that raises OMP preference does not add inspection. An application-aware routing SLA reacts to jitter, loss, or latency. It does not match exploit signatures. Cloud OnRamp for SaaS measures path quality for enabled applications. Its probes are not an intrusion-prevention engine for general internet traffic. Exam caveat: signatures see what the policy can observe. Encrypted payloads may need the TLS inspection you enable in that same security policy, or the engine may only see limited metadata. Operational check: generate a test flow that matches a known signature in a lab and confirm the security log on that zone pair records the block.