An enterprise operating critical national infrastructure needs a WAN design that keeps centralized control over internet egress while still allowing branch sites to run their own edge services with low latency and improved resiliency. According to the design guidance, which Cisco architecture and platform combination is recommended?