A retailer is standing up its first SOC. Compliance requires the management plane to stay in its own data center as a virtual machine on the existing cluster, and the design must use one management console for every device. The fleet is 24 branch FTD appliances plus six FTDv instances in AWS that already reach the data center over an IPsec tunnel. How should the AWS firewalls be registered with the on-premises virtual Management Center?
Select an answer to reveal the explanation.
Short Explanation
You don't need a second console just because a firewall runs in a cloud region. Register each FTDv with the on-premises FMCv using the required registration details and management connectivity over the tunnel. In the end, reachability is essential for registration.
Full Explanation
Registering each AWS FTDv to the on-premises FMCv meets both design constraints: the management plane remains a virtual machine on the existing data-center cluster, and one console manages the entire fleet. The FTDv instances already have an IPsec path to the data center, but that alone does not prove the management channel is reachable; verify the required routing, access rules, and connectivity, then use the matching registration key when adding each device. A physical FMC appliance could centrally manage the branch and AWS devices, but it would violate the requirement that the management plane run as a VM on the existing cluster. A second FMCv is a conventional way to separate management domains or distribute load, yet it would leave the retailer with two consoles rather than one for every device. Hosting a single FMCv in AWS could provide centralized management and allow branch traffic to traverse the tunnel, but it places the management plane outside the required data center. Exam caveat: an established IPsec tunnel does not automatically provide the routes, ports, or access policy needed for FTD management. Practical check: confirm bidirectional management-channel reachability from each FTDv to the FMCv before registration.