A financial services company is designing a three-tier application in a single VPC. The public-facing web tier sits in public subnets behind an internet-facing load balancer. The application tier resides in private subnets and must receive traffic only from the web tier, distributed evenly across multiple application instances. Compliance rules prohibit the application tier from being reachable from the internet. Which design best distributes traffic to the application tier while satisfying the requirement?