You manage a virtual network named VNet1 that contains a subnet named Subnet1. For compliance reasons, you must ensure that VMs in Subnet1 are completely prevented from initiating outbound connections to the internet, while still allowing traffic within VNet1. You decide to use a user-defined route (UDR) associated with Subnet1. Which next hop type should you configure for the route with address prefix 0.0.0.0/0?