What is the role of Threat Monitoring in SD-WAN?

• A. Threat Monitoring simply logs events without enforcement.
• B. Threat Monitoring uses signature-based antivirus on endpoints only.
• C. Threat Monitoring detects security events and anomalies across the fabric using integrated policies and edge firewall capabilities; provides alerting and enforcement.
• D. Threat Monitoring replaces the need for any firewall.

Answer: (C)

Threat Monitoring in SD-WAN focuses on detecting security events and anomalies across the fabric and enforcing protective actions through integrated policies and edge firewall capabilities. It continuously analyzes traffic at the edge and between sites—branches, data centers, and cloud traffic—using threat intelligence, signature- and behavior-based detection, and policy-driven rules to spot unusual patterns, suspicious activity, or policy violations. When something notable is found, it can trigger alerts and automatically enforce actions defined by the security policy, such as blocking traffic, quarantining a device, or steering traffic to a remediation path. This provides broad visibility and control across the network, not just on endpoints, and it works in concert with firewall features at the edge rather than replacing them.