RetailCo runs a hub-spoke design using a Secured Virtual Hub with Azure Firewall. They want all internet-bound traffic from spokes to be inspected centrally. Which hub route table configuration will ensure centralized egress and avoid hairpinning or bypass from the spokes?

This option correctly leverages Azure Virtual WAN's capabilities for centralized internet egress. By creating a hub route table with a 0.0.0.0/0 route pointing to the Azure Firewall's private IP and setting routing intent for internet traffic inspection, all internet-bound traffic from associated spokes will be directed through the Firewall in the secured hub. Associating this route table with each spoke connection ensures consistent policy enforcement and prevents spokes from bypassing the firewall, avoiding hairpinning. The other options are incorrect: Creating UDRs on every spoke subnet and configuring the Firewall in transparent mode is not the recommended or most efficient approach for Virtual WAN and Secured Virtual Hubs. Transparent mode is not a standard Azure Firewall configuration for this scenario. Installing Azure Route Server in each spoke is an overly complex and unnecessary solution for this requirement when Virtual WAN's routing capabilities are designed for it. Enabling Forced tunneling on VPN gateways is typically for on-premises connectivity and would not directly route all VNet internet traffic through the Azure Firewall in the hub in this manner.