A company needs to design a VPC for a highly secure application that involves both public-facing components and sensitive back-end servers. What is the best practice for network segmentation in this scenario?