Hub-and-spoke topology centralizes shared services (firewall, DNS (Domain Name System), identity) in a hub VNet/VPC (Virtual Private Cloud); workloads live in spokes.
SD-WAN replaces MPLS (Multiprotocol Label Switching) with internet + smart routing. Cheaper, more flexible.
Micro-segmentation enforces east-west traffic rules between workloads, not just north-south.