Exercise 1: Standard-User-by-Default and Database Security 3's Least-Privilege Principle — Possible Solution
====================================================================

WHAT THE STANDARD-USER-BY-DEFAULT PRACTICE ACTUALLY DOES
------------------------------
Per this chapter, "running day-to-day as a standard user, with a
separate administrator account reserved for the occasions that
genuinely need it" limits what any given signed-in session is capable
of doing at any moment - a standard user cannot install software,
change system-wide settings, or modify other accounts, even if
something malicious were running in that session.

WHAT DATABASE SECURITY 3 TEACHES FOR DATABASE ACCOUNTS
------------------------------
Least-privilege account design, as referenced in this chapter, means
granting a database account only the specific permissions it actually
needs for its job - not blanket administrative rights "just in case."
A service account that only needs to read one table shouldn't also be
able to drop the entire database.

WHY THESE ARE THE SAME PRINCIPLE, JUST APPLIED TO DIFFERENT ACCOUNTS
------------------------------
Per this chapter, "a compromised standard-user session can do
meaningfully less damage than a compromised administrator session, for
exactly the same underlying reason a database service account with
only the permissions it actually needs limits the blast radius of a
SQL injection." In both cases, the account itself is deliberately
under-provisioned relative to what it could theoretically be granted,
specifically so that if something goes wrong - malware running in a
desktop session, or a SQL injection reaching a database account - the
damage is capped by what that specific account is actually allowed to
do, not by what the attacker wanted to do.

WHY THIS FRAMING MATTERS PRACTICALLY
------------------------------
Recognizing this as the same underlying principle, rather than two
unrelated best practices, makes it easier to generalize the reasoning
to other accounts and systems: the question in each case isn't "is
this user trustworthy," it's "does this account need this level of
access for what it actually does day to day."

WHY THIS WORKS AS AN ANSWER
------------------------------
It restates what standard-user-by-default actually restricts, restates
the database least-privilege principle it's being compared to, and
explains precisely why "blast radius" is the shared underlying logic
connecting both - a compromised or misused account can only do as much
damage as its own granted permissions allow, regardless of which
system it belongs to.