A cloud security team is designing an architecture for a financial services application that must comply with strict regulatory requirements. To protect sensitive data, they decide to implement network segmentation and isolation. Which of the following BEST ensures that the database tier remains inaccessible from the internet while allowing only the application servers to communicate with it?