An application server needs database access, while unrelated workloads must not reach the database. Which network rule best fits?

1. Expose the database publicly and rely only on an obscure port
2. Allow all traffic from any instance with an administrator's name
3. Permit the application workload's required database flow and deny unrelated sources
4. Permit every internal subnet because all addresses are private