A public ALB forwards HTTPS traffic to application instances on TCP 8080. Those instances connect to RDS for PostgreSQL on TCP 5432. The application and database are private. Which TWO inbound security-group rules enforce access between these tiers without hard-coded instance IP addresses? (Choose TWO.)

1. Allow TCP 8080 on the application security group from the ALB's DNS name.
2. Allow TCP 8080 on the application security group from the ALB security group.
3. Allow TCP 5432 on the database security group from the application security group.
4. Allow TCP 5432 on the database security group from 0.0.0.0/0.
5. Allow all inbound ports on the application security group from the entire VPC CIDR.