Oracle's Hub-and-Spoke design guidance defines an important UDR rule for Oracle AI Database@Azure delegated subnets: the route prefix must be at least as specific as the delegated subnet CIDR . A /24 delegated subnet therefore cannot be reliably represented by a broader /16 route when the architecture requires the delegated subnet-specific path.

The less-specific route can fail to take precedence over more-specific system or service routes. This creates the possibility that traffic takes one route toward the database but returns through a different route. Such asymmetric routing is especially problematic with Azure Firewall or an NVA because stateful firewalls expect both directions of a connection to traverse the same inspection point. If the return packet follows a different path, the firewall can drop the session.

A UDR has no mechanism for duplicating VNICs, changing SQL*Net encryption, or resizing the underlying subnet. It simply influences Layer-3 forwarding.

Therefore, A accurately describes the documented routing consequence.

Study Guide reference: Configure Oracle AI Database@Azure Networking — UDR prefix specificity, delegated subnet routing, Hub-and-Spoke and asymmetric routing prevention.

===============