Given two spokes behind one SD‑WAN hub, which two features are required to enable dynamic spoke‑to‑spoke tunnels?

To enable dynamic spoke-to-spoke tunnels in a Cisco SD-WAN fabric, two key features are required. First, a control policy with the tloc-action backup command must be applied on the hub. This command instructs the hub to advertise the TLOCs (Transport Locators) of spokes to other spokes, allowing them to discover each other and form direct tunnels. Without this, spokes would only know how to reach each other via the hub. Second, the traffic engineering service must be enabled on the spokes. This service is essential for spokes to dynamically establish direct IPsec tunnels between themselves once they learn each other's TLOC information from the hub. Incorrect options: Applying tloc-action backup on spokes is not necessary for spoke-to-spoke tunnels; it's the hub's role to facilitate this discovery. Enabling traffic engineering service on the hub is not directly required for spokes to form direct tunnels with each other. The tloc-list command is used for defining specific TLOCs, not for enabling dynamic spoke-to-spoke tunnel formation.