Which network design should the solutions architect recommend to meet these requirements?

A solution architect at a company is designing the architecture for a two-tiered web application. The web application is composed of an internet facing application load balancer that forwards traffic to an auto scaling group of amazon EC2 instances. The EC2 instances must be able to access a database that runs on Amazon RDS.

The company has requested a defence-in-depth approach to the network layout. The company does not want to rely solely on security groups or network ACLs. Only the minimum resources that are necessary should be routable from the internet.

Which network design should the solutions architect recommend to meet these requirements?
A . Place the ALB, EC2 instances and RDS database in private subnets.
B . Place the ALB in public subnets. Place the EC2 instances and RDS database in private subnets
C . Place the ALB and EC2 instances in public subnets. Place the RDS database in private subnets
D . Place the ALB outside the VP
E . Place the EC2 instances and RDS database in private subnets.

Answer: B