A security engineer is designing a Secure Firewall Threat Defense cluster for a data center that must scale past a pair of appliances. One node has to coordinate cluster health monitoring and the policy updates arriving from Secure Firewall Management Center, while every node still forwards production traffic and a dedicated cluster control link joins the nodes together. Which part of this cluster design performs those coordination duties while traffic keeps flowing?

In a Secure Firewall Threat Defense cluster the members elect a control unit, and that elected appliance owns the coordination work: it runs cluster health monitoring, handles the configuration and policy updates that arrive from Secure Firewall Management Center, and still forwards production traffic like every other node. Because coordination sits on one elected member, the data units concentrate on forwarding, the cluster scales past a pair, and a single policy stays in force across the group. The management center approach fails by concept because the Firewall Management Center sits outside the cluster: its changes take hold on the control unit first and are then replicated to the data units. The active and standby high availability approach fails because that design is fixed at two appliances and cannot meet the stated scale requirement. The cluster control link approach fails because the link is the transport between nodes, not a role that performs work. Exam caveat: the control role is elected by priority, so it can move when the current control unit fails. Practical check after deployment: confirm one node is listed as control unit and that the link carries both control and data traffic.