Exercise 2: External vs. Internal Engagements, and the dbsec1-1 Connection — Possible Solution
====================================================================

THE REAL DIFFERENCE BETWEEN EXTERNAL AND INTERNAL
------------------------------
Per this chapter's own explanation, an External engagement tests
"from outside the organization's own network, simulating an
internet-based attacker" — this is the threat model most of this
site's own web-application courses (xss1, csrf1, sqli1) already
assume: an attacker reaching the target over the public internet,
with no pre-existing foothold inside the network.

An Internal engagement instead tests "from inside the network,"
simulating one of three starting positions the chapter names
explicitly: "a compromised internal machine, a phishing victim's own
foothold, or a malicious insider." The defining difference isn't the
tools or techniques used — it's the STARTING POSITION: whether the
simulated attacker begins outside the network's perimeter, or already
has some form of legitimate or compromised access from within it.

HOW THIS CONNECTS TO DBSEC1-1'S OWN INSIDER-THREAT MATERIAL
------------------------------
Per this chapter, an Internal engagement is described as "a direct
real-world instance of dbsec1-1's own insider-threat material:
someone who already has legitimate network access, tested from that
exact starting position." dbsec1-1 covers the infrastructure threat
model specifically including insider threats as a real risk category
distinct from the external, internet-facing attacks that courses like
sqli1 and xss1 focus on. An Internal penetration test is essentially
that same insider-threat scenario turned into an actual, authorized,
hands-on test: rather than just discussing the risk conceptually (as
dbsec1-1 does), an Internal engagement actually simulates it, with a
real tester starting from inside the network exactly the way a
malicious insider or a phishing victim would.

WHY THIS WORKS AS AN ANSWER
------------------------------
It defines External vs. Internal using the chapter's own precise
language (starting position, not technique), and explicitly ties the
Internal category back to dbsec1-1's insider-threat material as the
chapter itself frames the connection, rather than treating the two
courses as unrelated.