Web and database instances share a subnet, but only database VNICs should accept TCP traffic on the database listener port from the application tier. Which control is best suited to this resource grouping?

1. An NSG for the database VNICs with an appropriately scoped ingress rule
2. A broad subnet security-list rule allowing the listener port from every source
3. A new display name for the database instances
4. A route table entry alone