A SaaS company runs FTD virtual instances in two AWS regions and wants one place to build and push policy. Management interfaces must sit in a separate VPC that only the security team's jump hosts can reach, and management traffic must stay clear of the congested site-to-cloud link. Which management placement for these virtual appliances meets all three requirements?
Select an answer to reveal the explanation.
Short Explanation
Running the manager in its own network keeps policy work away from production traffic and the office link. Your cloud instances still pair over their management interface using cloud network connectivity, so management traffic need not cross the VPN. It's like giving the control room its own door instead of walking through the factory floor.
Full Explanation
A single Management Center in a dedicated management VPC provides one place to build and push policy, while placing the FTD management interfaces there keeps management separate from workload networking. Limiting reachability to the security team's jump hosts satisfies the access boundary, and registering each FTD through its management interface avoids sending management traffic over the congested site-to-cloud link. The headquarters approach is a common centralized design, but it sends management traffic across the very VPN link the scenario says to avoid. Regional Management Centers can improve locality and keep traffic within each region, but they split policy administration across two control points rather than providing one place to manage it. Allowing an administrator workstation subnet as well as jump hosts may be a familiar access pattern, but it violates the explicit requirement that only the jump hosts can reach management interfaces. Exam caveat: centralized policy management does not by itself determine the path taken by management traffic; interface selection and routing matter too. Practical check: inspect VPC attachments, route tables, security-group rules, and FTD registration settings to confirm management endpoints are reachable only from jump hosts and that their traffic does not traverse the site-to-cloud link.