A data center wants one physical Cisco Secure Firewall chassis to serve three business units. Each unit needs its own independently managed FTD policy and dedicated hardware resources, so that rebooting or upgrading one unit's firewall does not affect the others. Which capability fits?
Select an answer to reveal the explanation.
Short Explanation
Think of an apartment building instead of one big shared house: each tenant gets their own walls, utilities and front door. Multi-instance carves a chassis into independent FTD instances with dedicated resources. If you pick anything that still runs one shared FTD, one reboot hits everyone.
Full Explanation
Multi-instance capability lets supported Secure Firewall hardware host several FTD container instances on one chassis. Each instance is allocated its own CPU and memory, runs its own software, and is managed as a separate device with its own policies, so one instance can be rebooted or upgraded without disturbing the others. That combination of resource isolation, independent lifecycle and separate policy is what a multi-tenant data center needs. Clustering combines several physical units into one logical firewall for throughput and resilience; it presents a single policy and a single device, the opposite of tenant separation. Transparent mode with a bridge group per unit separates Layer 2 segments within one FTD, but every bridge group shares the same software, resources and reboot. Policy inheritance lets a parent access control policy define common rules that child policies refine; it organizes rules, but all children still apply to the same single device and share its fate. Exam caveat: the ASA offers multiple context mode for virtualization, but FTD uses multi-instance, so for FTD-based answers expect container instances, not contexts. Operational check: confirm each instance appears as its own managed device in the manager, check its resource profile, and test that restarting one instance leaves traffic through the others unaffected.