A hub firewall must inspect spoke-to-spoke traffic. What must be true of the routing design?

1. A firewall IAM policy replaces all VCN route entries.
2. Every VCN attachment automatically sends all traffic through the firewall.
3. Forward and return routes must steer the intended traffic through the supported inspection path.
4. Different spoke CIDRs must intentionally overlap.