Application and database subnets are separated. Which network design best protects the database while preserving SAP communication?

1. Permit all internet traffic to the database
2. Permit required application-to-database flows and authorized management paths explicitly
3. Deny every subnet-to-subnet flow
4. Rely only on subnet names to enforce isolation