What should an Architect recommend UC do to secure their database to only trusted locations?

Universal Containers (UC) has a Heroku Postgres database attached toa Heroku app, which is running in the Common Runtime.

What should an Architect recommend UC do to secure their database to only trusted locations?
A . Move the database and the app into the Private Space.
B . Add a Trusted IP range to the Heroku Postgresconfiguration.
C . Set up a VPN from the trusted locations to the app.
D . Set up a VPC in a one-off dyno when access to Heroku Postgres is needed.

Answer: A