which of the following is an optional security control that can be applied at the subnet layer of a vpc