You manage a VNet named vnet-prod that contains a subnet, snet-pci, hosting servers subject to strict compliance. A route table is associated with snet-pci. Security requires that these servers must NOT be able to reach the internet directly, and any packets destined for internet addresses (0.0.0.0/0) must be silently dropped inside Azure without being forwarded to any appliance or gateway. Which user-defined route configuration meets this requirement?