Contoso is evaluating whether to use Virtual WAN Basic or Standard SKU. They need hub-to-hub transit, support for Secured Virtual Hubs (Azure Firewall via Firewall Manager), and higher scale for VPN and ExpressRoute. Which statement correctly describes the feature difference and recommended migration path?

The correct answer accurately states that Virtual WAN Basic does not support advanced features like hub-to-hub transit or Secured Virtual Hubs (Azure Firewall integration). To gain these capabilities, you must deploy a new Virtual WAN with the Standard SKU and then migrate your existing hubs and connections to it. There is no direct in-place upgrade path from Basic to Standard. The incorrect options are misleading: An in-place upgrade from Virtual WAN Basic to Standard is not supported, making the second option false. Virtual WAN Basic and Standard are not functionally identical; Standard offers significant additional features, disproving the third option. Standard SKU provides more than just higher throughput; hub-to-hub transit and secured hubs are exclusive to Standard and are not available in Basic, even as preview features, making the fourth option incorrect.