Soru

An enterprise is designing the network routing topology for an Azure environment. The topology includes the following components:
- A hub virtual network named `vnet-hub-cus` ($10.100.0.0/16$) containing an Azure Firewall with the private IP address $10.100.2.4$ and an ExpressRoute virtual network gateway.
- A production spoke virtual network named `vnet-prod-spoke` ($10.110.0.0/16$) with a subnet named `snet-prod-app` ($10.110.1.0/24$).
- A shared services spoke virtual network named `vnet-shared-spoke` ($10.120.0.0/16$) with a subnet named `snet-shared-db` ($10.120.1.0/24$).

The virtual networks `vnet-prod-spoke` and `vnet-shared-spoke` are peered directly with `vnet-hub-cus` but are not peered with each other.

The design must meet the following requirements:
- All traffic between `snet-prod-app` and `snet-shared-db` must be routed through the Azure Firewall for inspection.
- Virtual machines in `snet-prod-app` must be able to communicate with the on-premises network ($172.16.0.0/12$) via the ExpressRoute gateway.
- Traffic between virtual machines within the same subnet (`snet-prod-app`) must remain local and bypass the Azure Firewall.

Which TWO configurations should you implement to meet these requirements?