A financial services enterprise is deploying a Cisco SD-WAN fabric and needs private connectivity from its on-premises data center to workloads running in Microsoft Azure. Compliance rules prohibit any of this traffic from traversing the public internet. The network team has provisioned an Azure ExpressRoute circuit and now must configure the correct routing domain (peering type) so that traffic destined for their Azure virtual networks stays private. Which ExpressRoute peering type should they configure for reaching resources inside their Azure VNets?