C

Create public subnets for web servers and private subnets for database servers in your VCN, and associate separate security lists and route tables for each subnet.

When you create a subnet, by default it's considered public, which means instances in that subnet are allowed to have public IP addresses. Whoever launches the instance chooses whether it has a public IP address. You can override that behavior when creating the subnet and request that it be private, which means instances launched in the subnet are prohibited from having public IP addresses. Network administrators can, therefore, ensure that instances in the subnet have no internet access, even if the VCN has a working internet gateway, and security rules and firewall rules allow the traffic.

Security list is equally applicable to all instance in a subnet so the ans provided by no means restrict access to DB. Most suitable ans is Option C.

Yes, I agree with your comments. The correct answer is C.

Answer to qn 54 does not seem to be correct to me, should it not be C ?