An Oracle AI Database@Azure delegated subnet remains part of the customer's Azure VNet and can use supported Azure networking controls. Two fundamental controls are Network Security Groups (NSGs) and Azure route tables containing User-Defined Routes .

An NSG performs traffic filtering by applying inbound and outbound security rules based on criteria such as source, destination, protocol, and port. This allows organizations to enforce database-access policies at the Azure network layer. Route tables provide forwarding control, allowing traffic to be directed through Azure Firewall, an NVA, a virtual network gateway, or other supported next-hop architecture.

Oracle's delegated-subnet design documentation explicitly states that because the delegated subnet belongs to the customer's VNet, it can leverage Azure networking capabilities including NSGs and routing tables . This enables private application-to-database communication while retaining enterprise routing and security controls.

Azure Load Balancer backend pools and Application Gateway ingress controllers are application/load-balancing constructs and are not the two subnet-associated controls identified for this Oracle database networking requirement.

Study Guide reference: Configure Oracle AI Database@Azure Networking — delegated subnet design, NSGs, Azure route tables, UDRs and traffic controls.

===============