A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application listens on ports 80 and 443 at the ALB, which terminates SSL and forwards only HTTP (port 80) to instances. The ALB is in public subnets associated with a network ACL named NACL1. The application instances are in private subnets associated with NACL2. An Amazon RDS for PostgreSQL DB instance (port 5432) is in a separate private subnet associated with NACL3. All NACLs currently allow all inbound and outbound traffic. Which network ACL changes will harden security while preserving functionality?

The correct option hardens security by applying the principle of least privilege to NACL3, which protects the RDS database. It allows inbound PostgreSQL traffic (port 5432) only from the specific subnets where the application instances reside, preventing unauthorized access from other networks. The outbound rule allows ephemeral ports (1024-65536) back to the application instances, which is necessary for the database to respond to queries. Removing the default allow-all rules ensures only explicitly permitted traffic flows. The first incorrect option is less secure because NACLs cannot reference other NACLs; they must use CIDR blocks. The third and fourth options focus on NACL2, which protects the application instances, but the question specifically asks to harden NACL3 for the database. While NACL2 also needs hardening, the provided options for NACL3 are the most appropriate for securing the database.