Contoso Ltd. has a Virtual WAN with a hub in West US. They deployed three spoke VNets (app-spoke, db-spoke, mgmt-spoke) attached to the hub. The security team requires that db-spoke prefixes (10.10.2.0/24) are never learned by app-spoke and mgmt-spoke, but app-spoke must still be reachable from on-prem via a Site-to-Site VPN connection attached to the same hub. How should you configure the Virtual WAN hub route tables to accomplish this?

The correct approach is to create a custom hub route table with no propagation, add a static route for 10.10.2.0/24 pointing to the on-prem VPN next hop IP, and associate the table to the on-prem VPN connection only. This ensures that the on-premises network can reach the db-spoke, while preventing the db-spoke prefixes from being propagated to the app-spoke and mgmt-spoke VNets. Incorrect options: Creating a static route for 10.10.2.0/24 with next hop 'None' would blackhole traffic to db-spoke, making it unreachable from anywhere. Enabling propagation only from the on-prem VPN connection on a custom table associated with app-spoke and mgmt-spoke would not hide db-spoke prefixes if they are propagated from the db-spoke connection itself. Using the default hub route table and ACLs is not a native Virtual WAN routing feature; Virtual WAN uses route tables for traffic management, not ACLs for route filtering.