A company hosts an internal web-based application for employees on its on-premises network, accessible via a VPN. The application operates on a fleet of Amazon EC2 instances within a private subnet, behind a Network Load Balancer (NLB) in the same subnet, and is managed by an Amazon EC2 Auto Scaling group. Following a recent SQL injection attack, a network engineer needs to implement measures to prevent future SQL injection attacks.

Which three steps should be taken to meet these requirements?