I believe I've answered my own question with this link
https://coderanch.com/t/188630/java-developer-SCJD/certification/Exceptions-created-as-member-classes A member class is not a class that has visibility within a given package. This clears up my misunderstanding.
So obviously it makes sense to have these exceptions as public.
However for my other question, if I defined an exception in my business layer, would it be best to put that exception in the suncertify.db package or put that exception in my business layer package?