Professional security devices should be deployed at the headquarters or another centralized Internet-access site. Under centralized Internet access, branch Internet traffic is first carried through the SD-WAN overlay to the centralized gateway. The headquarters security infrastructure then performs access control and security inspection before forwarding the traffic to the Internet.
This approach is appropriate when branch CPEs lack sufficient processing capacity or advanced security functions. A centralized firewall or dedicated security platform can provide intrusion prevention, antivirus inspection, URL filtering, application control, content security, and unified logging. It also allows the enterprise to enforce one consistent security policy instead of maintaining separate advanced configurations at every branch.
Deploying advanced security capabilities on each CPE, as proposed in option C, is a distributed local-breakout design and does not satisfy the stated limitation concerning security-processing capability. Third-party cloud security services can be used in some site-to-cloud or secure Internet-access architectures, but they are not the intended headquarters-based centralized solution in this question.
Huawei explicitly states that centralized Internet traffic is diverted to the centralized access site and that the firewall function is deployed there to secure Internet services. Therefore, option D is correct.
==================
