A network architecture pattern where a central VNet (hub) hosts shared services (firewall, VPN Gateway, identity services) and peripheral VNets (spokes) contain the actual workloads, connected to the hub via peering.
The most frequently tested network design pattern on AZ-305. Spokes don't connect directly to each other (unless you force traffic through the hub with a route table). A more modern alternative is Virtual WAN, which simplifies management at large scale.
Hub-and-spoke topology is a concept that can show up on the exam. Check the full guide to see it in context.