A Sunbird production deployment should expose its learner web entry point but keep backend databases private. Which network design is appropriate?

1. A single unrestricted subnet rule permitting every source to every port
2. Public IP addresses and unrestricted inbound access on every database
3. Public ingress through a controlled load balancer with private backend tiers
4. No routing between application and database tiers