Which two steps let a specific department require firewall protection to reach the data center without including other departments? (Choose two.)

To provide specific firewall protection for one department without affecting others, two key steps are required. First, the regional hub must advertise the firewall service's availability. This allows the SD-WAN fabric to recognize and route traffic to the firewall. Second, deploying a service-chained firewall service per VPN ensures that only the traffic from the designated department's VPN is directed through that specific firewall instance. This isolates the firewall policy to that department, preventing other departments from being subjected to or benefiting from the same firewall rules. "Use classification, policing, and marking" is for traffic management, not service chaining. "Advertise to vSmart controllers" is too general; the key is what is advertised (the service). "Apply data policies at vEdge" is for traffic manipulation, not service deployment.