Your company is deploying Azure Firewall to protect a small branch-office virtual network that expects a peak throughput of roughly 200 Mbps and around 40 concurrent users. Management wants the lowest-cost firewall SKU that still supports built-in threat intelligence in alert mode. However, the security team notes that the deployment must include a specific companion component for the control plane to function. Which SKU should you choose, and what additional resource is mandatory for it?