A database should accept traffic only from the application tier. Which control best expresses tier membership?

1. A cost-center tag without any network policy.
2. Appropriate NSG membership and narrowly scoped supported ingress rules.
3. Public ingress from 0.0.0.0/0 on every database port.
4. An application title containing the database's private IP.