Your Google Cloud project ( my-project ) includes a VPC with two subnets: subnet-a (10.128.0.0/20) for database servers subnet-b (172.16.0.0/24) for application and web servers You plan to deploy: Database servers in subnet-a Application servers in subnet-b Your objective is to permit only database traffic (TCP port 3306) from application servers to database servers using firewall rules . Which configuration should you implement?