A retailer is standing up its first two virtual Secure Firewall Threat Defense appliances: one on an on-premises ESXi cluster and one in an Azure VNet. Both must be administered from the existing on-premises Secure Firewall Management Center with a single access control policy, and the Azure network security group must allow management traffic from the FMC. Which virtual appliance management design satisfies all three requirements?

Register both virtual appliances to the retailer’s existing on-premises FMC with a registration key, then use that FMC to assign the same access control policy to each. This satisfies the requirement to use the existing manager and one shared policy, while the Azure NSG can be configured to allow management traffic from the FMC. Registering both appliances to a cloud-delivered FMC tenant could provide shared policy management, but it does not use the required existing on-premises FMC. Registering to the existing FMC while assigning separate site-specific access control policies, even when they share a common base policy, does not provide one shared access control policy for both appliances. Using the existing FMC and its shared policy with an Azure NSG that permits only outbound management traffic also fails: outbound-only access is not equivalent to allowing management traffic from the FMC. Exam caveat: a common base policy is not necessarily the same as assigning one shared access control policy, and the management platform is distinct from the permitted network flow. Practical check: confirm both devices appear in the existing FMC, verify that the same access control policy is assigned to each, and check that the Azure NSG allows the required FMC-originated management traffic.