A SysOps administrator recently launched an application consisting of web servers running on Amazon EC2 instances, an Amazon ElastiCache cluster communicating on port 6379, and an Amazon RDS for PostgreSQL DB instance communicating on port 5432. The web servers are in the security group web-sg, the ElastiCache cluster is in the security group cache-sg, and the DB instance is in the security group database-sg.
The application fails on start, with the error message "Unable to connect to the database".
The rules in web-sg are as follows.

Which change should the SysOps administrator make to web-sg to correct the issue without compromising security?

A. Add a new inbound rule: database-sg TCP 5432
B. Add a new outbound rule: database-sg TCP 5432
C. Add a new outbound rule: 0.0.0.0/0 All Traffic 0-65535
D. Change the outbound rule to: cache-sg TCP 5432