A Hub-and-Spoke design separates shared connectivity and security services from workload networks. For Oracle AI Database@Azure, Oracle documents a Hub VNet that hosts centralized services such as Azure Firewall or a third-party NVA and a dedicated spoke VNet for Oracle AI Database@Azure containing the delegated subnet .

The Oracle database spoke is connected to the hub through Azure VNet peering. User-Defined Routes are then used to direct traffic through the hub's firewall or NVA when centralized inspection is required. Application spokes can similarly route database-bound traffic toward the security appliance, while return routes on the database spoke preserve the required symmetric traffic path.

Azure VM Scale Sets are application-compute constructs and do not form the essential Hub-and-Spoke network topology. OCI FastConnect is an OCI/hybrid connectivity capability rather than the Azure-side Hub-and-Spoke component described by this scenario.

Therefore, B and C identify the essential architecture: the Oracle database workload is isolated in a spoke VNet, while the Hub VNet provides centralized traffic inspection and security enforcement.

Study Guide reference: Configure Oracle AI Database@Azure Networking — Hub-and-Spoke architecture, VNet peering, delegated subnet, Azure Firewall/NVA and UDR routing.

===============