The image shows a hub-and-spoke VNet peering topology with a single Azure Region hosting a Spoke VNet 1 10.2.0.0/24 peering with Hub VNet 10.1.0.0/16 peering with Data VNet 1 10.0.28.0/22.

• Spoke VNet 1 hosts a Workload subnet 10.2.0.0/24 hosting an Application VM.
• Hub VNet hosts a Gateway subnet 10.1.1.0/27 hosting an Azure Firewall or NVA.
• Data VNet 1 hosts a Client subnet 10.0.28.0/27 hosting Oracle Database@Azure.