You have a three-tier application running on Compute Engine: web servers, application servers, and database servers. You want to create firewall rules to ensure that ONLY the application servers can communicate with the database servers on port 3306.

Which TWO actions should you take to configure this securely using network tags? (Select TWO)

Add the tag 'app-server' to the application instances and 'db-server' to the database instances.

Create an ingress firewall rule targeting 'db-server' that allows port 3306 from source tags 'app-server'.

Create an egress firewall rule on the database servers to block all outbound traffic.

Create an ingress firewall rule targeting 'app-server' that allows port 3306 from source tags 'db-server'.

Assign a public IP to the database servers so the firewall rules can route the traffic.