The correct choice is Configure VPC peering between the ap-southeast-2 and eu-west-1 VPCs, add the required routes, and create an inbound rule in the eu-west-1 database security group that allows traffic from the ap-southeast-2 application server IP addresses. This option provides private, cross Region connectivity and places the allow rule on the database side where it belongs.

VPC peering supports inter Region private routing when you update the relevant route tables and ensure the CIDR ranges do not overlap. Security groups are regional so you cannot reference a security group in a different Region. For that reason you must allow the application server IP addresses or CIDR ranges on the destination database security group when using inter Region peering.

Create a VPC peering connection between the ap-southeast-2 VPC and the eu-west-1 VPC, update the relevant route tables, and add an inbound rule in the eu-west-1 database security group that references the security group ID of the application servers in ap-southeast-2 is incorrect because security groups cannot be referenced across Regions. The route changes would be valid but you cannot point a security group rule at a security group in another Region.

Set up AWS Transit Gateway in each Region with an inter-Region peering attachment, configure routing, and add an inbound rule in the eu-west-1 database security group that references the application server security group in ap-southeast-2 is not the best answer because cross Region security group references remain unsupported and Transit Gateway adds complexity that is not required for a single pair of VPCs. Transit Gateway can be useful at scale but it does not eliminate the regional scope of security groups.

Establish a VPC peering connection between the ap-southeast-2 and eu-west-1 VPCs, modify route tables as needed, and add an inbound rule in the ap-southeast-2 application security group that permits traffic from the eu-west-1 database server IP addresses is wrong because the allow rule must be applied on the destination resource. The database security group must permit incoming connections from the application IPs for the connection to succeed.

Full AWS Practitioner Certification Question