Soru

An enterprise is designing a high-availability hybrid network topology in Azure to support dynamic routing and traffic inspection. The design includes the following components:

* A hub virtual network named `vnet-hub-useast` ($10.10.0.0/16$) containing an Azure Route Server in the `RouteServerSubnet` ($10.10.1.0/24$) and two active-active Network Virtual Appliances (NVAs) in `subnet-nva` ($10.10.2.0/24$).
* A spoke virtual network named `vnet-spoke-prod` ($10.20.0.0/16$) containing `subnet-web` ($10.20.1.0/24$).
* A spoke virtual network named `vnet-spoke-data` ($10.30.0.0/16$) containing `subnet-db` ($10.30.1.0/24$).

The NVAs establish BGP sessions with the Azure Route Server. The Route Server is configured with Branch-to-Branch enabled to exchange routes between the NVAs and an ExpressRoute Gateway in the hub.

You need to design a routing solution that meets the following requirements:
1. Subnets in `vnet-spoke-prod` and `vnet-spoke-data` must dynamically receive the on-premises routes advertised by the NVAs via BGP.
2. All spoke-to-spoke traffic (between `vnet-spoke-prod` and `vnet-spoke-data`) must be directed through the NVAs for security inspection.
3. Local traffic within `vnet-spoke-prod` (destined within $10.20.0.0/16$) must not be sent to the NVAs.

Which two configurations should you include in the design? (Select two.)