The public web tier needs an inbound security-group rule permitting TCP 443 from Internet clients. Therefore, Option E is required. Security groups act as virtual firewalls and should expose only application ports required by the workload. Alibaba Cloud recommends allowing public access only to necessary web-service ports such as HTTPS 443 while keeping internal services inaccessible from the Internet.

For the database tier, access should be limited to ECS instances belonging to the web-server security group. Alibaba Cloud RDS for MySQL supports associating an ECS security group with an RDS instance, allowing ECS instances in that group to connect without adding every server address individually to an IP whitelist. This is particularly useful when application-server membership changes dynamically.

Option B is overly broad because every resource within the public vSwitch ' s CIDR could potentially be authorized rather than only the approved web tier. Option C would prevent legitimate database traffic. Option D is unnecessary because RDS access behaves as an allow-list model: only explicitly authorized addresses or associated security-group members should be granted database access.

Thus, Internet clients reach the web tier only over HTTPS, while MySQL accepts access only from the authorized application servers.

Study Guide reference: Securing Workloads on Alibaba Cloud — Security Groups, RDS access control, least privilege, and tiered network segmentation.

==================================================