A web tier and database tier share a VCN. Which control can express application-tier membership independently of subnet-wide security lists?

1. A budget assigned to each application.
2. One public DNS record per database user.
3. A subnet display-name convention alone.
4. Network security groups associated with the relevant VNICs.