Exercise 1: What Encryption at Rest Does and Doesn't Protect Against — Possible Solution
====================================================================

What it PROTECTS against: a physically stolen disk. Per the chapter,
if the raw storage medium itself is removed, lost, or accessed
outside the normal system -- say, a physical hard drive taken from a
data center, or a storage volume's raw bytes accessed directly without
going through the normal system that holds the decryption key -- the
data on it is unreadable without the encryption key. Someone who only
has the raw disk, without the key, gains nothing usable from it.

What it does NOT protect against: a compromised credential that
ALREADY has legitimate access to decrypt and read the data through
normal means. If an attacker compromises an application's credentials,
or an IAM identity (Chapter 6) that's been granted legitimate access
to the encrypted resource, the encryption is functionally irrelevant
to that attacker -- the SYSTEM itself decrypts the data automatically
and correctly on their behalf, exactly as it would for any legitimate
user, because from the system's perspective, this compromised
credential IS a legitimate, authorized requester.

Why the distinction matters:

Encryption at rest defends against one specific THREAT MODEL --
someone bypassing the normal system entirely and accessing the raw
storage directly. It does nothing to defend against a completely
different threat model -- someone going THROUGH the normal system
using stolen but valid credentials. These require entirely different
defenses: encryption for the first, and the access control / least
privilege material from Chapter 6 for the second. Neither one
substitutes for the other, which is exactly the chapter's own
tip-box point.

WHY THIS WORKS AS AN ANSWER
------------------------------
This distinguishes the two scenarios by WHICH PATH the attacker takes
to the data -- bypassing the system directly (stopped by encryption)
versus going through the system with valid-looking credentials (not
stopped by encryption at all) -- which is the precise mechanism behind
the chapter's own statement that "encryption is not a substitute for
the access control covered in Chapter 6."