A retailer has eight Threat Defense virtual appliances spread across two accounts on the same cloud provider and needs one place to build and push policy to all of them. Corporate requires that every management session travel only inside the cloud network and never ride the link to headquarters. Which virtual appliance management design keeps policy in one place while meeting that requirement?

A Secure Firewall Management Center virtual appliance inside the cloud network provides one place to author and deploy policy to all eight Threat Defense devices. With the manager and appliances reachable within the cloud network, management sessions need not traverse the corporate link to headquarters; a suitable shared-services network can support devices in both accounts, subject to routing and access controls. Deploying one Management Center in each account can limit administrative scope and allow policy templates to be shared, but templates do not make two centers a single management location: policy is still built and deployed from separate centers. A provider-connected colocation facility can offer private, reliable connectivity to cloud workloads, but its interconnect is outside the cloud network, so management sessions would not satisfy the required path constraint. The cloud provider’s native firewall policy manager can centrally manage its own native firewall service, but it does not manage Threat Defense virtual appliances, so it cannot meet the device requirement. Exam caveat: private connectivity is not necessarily connectivity that remains inside the cloud network. Practical check: verify that the Management Center version supports all eight device versions and that cloud routing, security rules, and cross-account permissions allow management traffic without a route through headquarters.