The branch subnets must each support up to 200 hosts, so /120 is the correct IPv6 prefix length from the available options. A /120 provides 256 IPv6 addresses, which satisfies the 200-host requirement. A /121 provides only 128 addresses, which is not enough. The parent block is 2a01:0c30:0016:7009::3800/118. A /118 has 10 host bits, so it contains 1024 addresses and spans from ::3800 through ::3bff. The valid /120 boundaries inside that parent are ::3800/120, ::3900/120, ::3a00/120, and ::3b00/120. From the listed choices, 2a01:0c30:0016:7009::3a00/120 and 2a01:0c30:0016:7009::3b00/120 both fall inside the parent allocation and provide enough address capacity. The /121 options are too small, and ::3c00/120 is outside the /118 parent range. This is a straightforward IPv6 prefix-boundary and capacity calculation. Reference topics: IPv6 subnetting, prefix length, address block boundaries, branch address planning.

The requirements point to a Layer 2 multipoint WAN service. VPLS provides an emulated Ethernet LAN across a provider network, allowing multiple sites to appear as if they are connected to the same Layer 2 domain. This supports full-mesh Layer 2 connectivity and preserves customer control over higher-layer services such as IPv6, multicast, routing protocols, and QoS markings. Because the provider delivers an Ethernet multipoint service, the enterprise can retain protocol independence rather than depending on the service provider to participate in IPv6 routing or multicast routing. CoS marking is also a Layer 2 QoS mechanism, so a Layer 2 VPN service is better aligned to the stated QoS requirement. VPWS is point-to-point rather than full-mesh multipoint, so it does not meet the topology requirement by itself. MPLS Layer 3 VPN is a provider-routed service and does not give the customer full Layer 2 mesh behavior. DMVPN is an overlay routed VPN and does not provide a native Layer 2 full-mesh service. Therefore, VPLS is the correct WAN connectivity option.

Because the wireless access points must remain in a common VLAN, the practical design is to align the HSRP active gateway with the spanning-tree root bridge for that VLAN. Unicast flooding commonly occurs when a Layer 2 domain is stretched between aggregation and access layers and the traffic path becomes asymmetric. If the HSRP active gateway is on one aggregation switch while STP forwards the Layer 2 path through a different aggregation switch, return traffic can be forced across inter-switch links and CAM table aging can create flooding conditions. Cisco campus design guidance emphasizes aligning Layer 2 and Layer 3 forwarding roles so the active default gateway and spanning-tree root are colocated for each VLAN. Migrating to routed access is usually the best long-term design, but it requires the APs to run on separate VLANs; the question states they use a common VLAN. Reducing ARP timers to match CAM timers can help some flooding cases, but it is not the core design fix offered here. Reference topics: HSRP and STP alignment, unicast flooding, Layer 2 campus design, wireless AP VLAN design.

PIM BSR is the best final design action because the source uses group 239.1.1.1, which is an administratively scoped ASM multicast group, and dense mode is not allowed. In PIM sparse mode, ASM groups require a rendezvous point so receivers can join the shared tree and sources can register. PIM SSM is not the right match for 239.1.1.1 because SSM normally uses the 232.0.0.0/8 group range and requires receivers to know the source address. Auto-RP can distribute RP information, but traditional Auto-RP discovery relies on multicast groups that often require sparse-dense behavior, which conflicts with the requirement that dense mode is not allowed. BSR is the standards-based PIM mechanism for dynamic RP discovery in sparse-mode networks and avoids static RP configuration on every router. Anycast RP is an RP redundancy design but still requires RP discovery or static RP configuration. Reference topics: PIM sparse mode, Bootstrap Router, ASM, RP discovery, administratively scoped multicast.

For model-driven telemetry with periodic updates, the architect must understand that each periodic update sends the subscribed data at the configured interval. Cisco telemetry guidance distinguishes periodic subscriptions from on-change subscriptions. A periodic subscription streams a full copy of the subscribed data element or table at each interval, even if the underlying state has not changed. That behavior is useful when the collector needs regular time-series samples, trending, or baseline monitoring, but it creates predictable bandwidth and collector-load requirements. On-change subscriptions are different: they publish updates when the subscribed state changes and are more efficient for state changes such as interface status, memory thresholds, or protocol adjacency m ovement. Empty subscription behavior and initial update timing may matter in specific implementations, but they are not the main design consideration in this question. Since the customer requires periodic updates, the design must size the transport, collector, retention system, and subscription intervals around repeated full data delivery. Reference topics: model-driven telemetry, periodic subscription, on-change subscription, YANG-modeled operational data, collector sizing.

Controller redundancy is the only viable answer among the listed choices. In Cisco SD-WAN, production control-plane resiliency is achieved by deploying redundant controller infrastructure so WAN Edge routers can maintain control connectivity even if a controller instance fails. Strictly speaking, vSmart controllers are the primary SD-WAN control-plane components because they distribute OMP routes, TLOC information, service routes, and policy. vManage is the management plane, and clustering vManage improves management-plane availability. However, the provided options do not include redundant vSmart controllers. Of the available answers, using multiple controller instances in a cluster is the closest redundancy design concept, while the other options do not provide SD-WAN controller redundancy. BFD on WAN Edge routers detects data-plane path failure, not control-plane controller failure. Deploying controllers on UCS or CSP affects hosting, not redundancy by itself. OMP manages overlay routes; it is not an underlay management mechanism. A complete professional design should include redundant vSmart, vBond, and vManage components across failure domains. Reference topics: Cisco SD-WAN control plane, controller redundancy, vSmart, vManage clustering, OMP.

DMVPN is preferred over individually configured point-to-point IPsec tunnels when a company has many branches because it scales the overlay more efficiently. A traditional IPsec tunnel design requires manual or template-based tunnel definitions for every required site-to-site relationship. As branches increase, tunnel count, configuration complexity, and operational overhead grow quickly. Cisco DMVPN combines multipoint GRE, NHRP, and IPsec so spokes can register with the hub and dynamically discover next-hop information for other spokes. This supports a hub-and-spoke control model while allowing dynamic spoke-to-spoke data tunnels when branch-to-branch traffic is required. That is why greater scalability and dynamic spoke-to-spoke tunnel creation are the two design advantages. AES-256 encryption is not unique to DMVPN because normal IPsec can also use strong encryption. Anycast gateway is unrelated to DMVPN WAN overlay design. Lower traffic overhead is not the best answer because DMVPN adds mGRE, NHRP, and IPsec encapsulation overhead; its advantage is operational scalability and dynamic tunnel establishment.

A dedicated management VRF is the correct feature when management protocols must traverse the production network but remain logically separated. The question describes in-band management because SSH, NTP, FTP, and SNMP are carried over the production network rather than over a separate physical console or out-of-band network. The design still requires routers and switches across different networks to be managed securely. A management VRF gives the management plane its own routing table, allowing the engineer to restrict management reachability, apply separate routing, and keep management traffic from leaking into user or service forwarding paths. Management Plane Protection can restrict which interfaces accept management-plane traffic, but it does not by itself provide separate routing across different networks. A terminal server or dedicated console connection is an out-of-band operational tool, not the production-network management design requested here. A dedicated management VRF per device is therefore the correct feature. Reference topics: in-band management, management VRF, SNMP and SSH reachability, management-plane segmentation, enterprise operations design.

LFA FRR is the correct improvement because it gives OSPF a precomputed repair path instead of waiting for normal SPF reconvergence after a component failure. Cisco describes OSPF LFA Fast Reroute as using a precomputed alternate next hop to reduce failure reaction time when the primary next hop fails. The forwarding plane can move traffic to the alternate path while the control plane reconverges, which directly addresses the short outage described in the question. Incremental SPF reduces CPU impact by recomputing only the affected part of the SPF tree, but it still relies on the post-failure SPF process. BFD detects a failure quickly, but by itself it does not install a loop-free repair path. Aggressive timers also improve detection but increase control-plane sensitivity and do not provide local repair. In an enterprise OSPF design where the complaint is outage during recomputation, LFA FRR is the stronger availability mechanism. Reference topics: OSPF Loop-Free Alternate, IP Fast Reroute, SPF convergence, local repair paths, routed resiliency.

The correct design is to use the same anycast RP address on loopback interfaces so receivers and sources register with their nearest available rendezvous point. Cisco Anycast RP designs use a common RP address advertised from multiple RP routers, allowing unicast routing to direct PIM joins and registers to the closest RP. MSDP is then used between the RP routers so each RP can learn about active sources registered to the other RP. This provides resilience and local registration while keeping RP reachability consistent for the multicast domain. Option B captures the key behavior: the RP loopback is configured with the same /32 address, and normal routing sends traffic to the closest RP. Configuring a hash value, group range splitting, or equal priority alone does not provide the Anycast RP behavior required here. A professional design should also use unique loopbacks for MSDP peer sessions while keeping the shared anycast loopback as the RP address. Reference topics: Anycast RP, MSDP, PIM-SM rendezvous points, source registration, multicast high availability.