Exercise 1: A Full Database Security Test Plan — Possible Solution
====================================================================

ACCOUNTS (Ch.2-3)
Check: list every database account; confirm none are shared across
multiple people/services.
Passing result: each account maps to exactly one person or one
service, with grants matching only what that specific account needs
(no ALL PRIVILEGES on an application account).

NETWORK EXPOSURE (Ch.4)
Check: attempt to connect to the database's port from outside its
private network (e.g. from a machine with no VPN/bastion access).
Passing result: the connection attempt fails/times out — the port is
unreachable from anywhere it shouldn't be, confirmed by bind address
and firewall rules matching what's documented.

ENCRYPTION (Ch.5-6)
Check: confirm TDE or full-disk encryption is actually enabled (not
just assumed); separately confirm any manual dump/backup tooling
produces encrypted output; attempt a connection with sslmode=require
vs verify-full and confirm the app is actually configured to use the
latter.
Passing result: data files, manual dumps, and live connections are all
independently confirmed encrypted — none relying on another layer's
protection covering them by accident.

AUDITING (Ch.7)
Check: attempt an action against a sensitive table and confirm it
appears in the audit log; confirm the logging destination is NOT
reachable/modifiable by the database's own application accounts.
Passing result: the action is logged, attributable to a specific
account, and stored somewhere a compromised DB account can't alter.

BACKUPS (Ch.8)
Check: actually restore the most recent backup into an isolated test
environment and verify the data matches expectations; confirm backup
storage access is scoped separately from the live database's access.
Passing result: the restore succeeds with complete, correct data, and
backup access requires different credentials/network path than the
live system.

HARDENING (Ch.9)
Check: query for any default/sample databases or accounts; check the
enabled feature list against what's actually used; check the running
version against the vendor's published CVE list.
Passing result: no leftover defaults, no enabled-but-unused features,
and no known unpatched vulnerabilities in the current version.