A defense-in-depth review reveals the perimeter firewall is the only control between the internet and a critical database server. Which additional architectural layer provides the most immediate risk reduction?

B is correct because introducing an application tier forces attackers to traverse two additional layers (WAF and application server) before reaching the database, embodying defense in depth. A is wrong because HA redundancy improves availability but does not add a security layer. C is wrong because logging improves visibility but does not reduce attack surface. D is wrong because AV on the database is a useful endpoint control but does not address the architectural problem of direct external reach.