An international organization has more than 100 firewalls in 50 locations. Which Panorama deployment mode would the organization install in multiple locations (beyond the need for disaster recovery)?

While Panorama is the central management system, deploying a full Panorama instance (which includes management and logging) in multiple locations for log collection purposes would be overkill and inefficient for just log aggregation.

A "management only" Panorama instance primarily handles configuration and policy management and does not specifically address the need for distributed log collection from many firewalls in various locations.

Panorama log collectors are deployed in multiple locations to aggregate logs from local firewalls efficiently, reducing the load on the central Panorama management server and providing regional log storage and forwarding capabilities for large-scale, geographically dispersed deployments. These collectors ensure all security events are captured and sent to Panorama for centralized analysis.

Threat management is a function of the firewalls and Panorama as a whole, not a distinct deployment mode for Panorama instances.