A network engineer is configuring a Cisco Catalyst SD-WAN branch router with two SIG (Secure Internet Gateway) tunnels to a cloud security provider. The security team requires that all internet-bound user traffic be inspected by the SIG service, and that if BOTH SIG tunnels fail, the traffic must be dropped rather than sent directly to the internet unprotected. Which SIG data policy configuration action achieves this requirement?