A retailer runs FTD virtual instances in a cloud VPC alongside its on-premises firewalls. The instances have only outbound connectivity, the existing site-to-site VPN already carries traffic to the data center where the Management Center lives, and the team wants one place to build and deploy policies for both environments. Where should the cloud instances be registered to keep one console and stay on the existing VPN?
Select an answer to reveal the explanation.
Short Explanation
Your existing VPN is like a private road to the on-premises Management Center, so register your cloud instances there to manage both environments from one console. Because FTD instances initiate their management connection, you don’t need public inbound access—as long as the required routes and connectivity are in place.
Full Explanation
Registering the cloud FTD instances to the on-premises Management Center over the existing site-to-site VPN meets both requirements: you build and deploy policy from the same console used for the on-premises firewalls, and management traffic uses the VPN already connected to the data center. Registering over outbound TLS via internet egress is a plausible management path, but it substitutes internet egress for the requirement to stay on the existing VPN; outbound connectivity alone does not make that path equivalent. Deploying a Management Center in the VPC is a valid way to manage cloud devices in their environment, but retaining a separate on-premises Management Center splits policy administration and deployment across consoles, contrary to the one-place requirement. Managing each cloud instance locally with FDM and forwarding events to the data center is workable when local administration is acceptable, but event visibility is not centralized policy control: you would still build and deploy policies separately. Exam caveat: distinguish Management Center registration and control-plane reachability from ordinary data-plane traffic; a VPN carrying data-center traffic does not automatically prove that required management ports and routes are available. Practical check: verify the cloud-to-Management-Center route over the VPN, required access-control rules and ports, and successful device registration before deployment.