Exercise 2: Auditing a Broken Setup — Possible Solution
====================================================================

FLAW 1: A single shared "admin" account is used by the whole team.
Chapter: 2.
Fix: create one individual account per team member (and per service),
each scoped to only the privileges that account genuinely needs.

FLAW 2: The database port is open to 0.0.0.0 "temporarily."
Chapter: 4.
Fix: bind the database to a private network address (or localhost, if
co-located with the application), add firewall rules allowlisting only
the specific hosts that need access, and route any human access
through a bastion host or VPN — "temporarily" is exactly the shortcut
this chapter warned becomes permanent.

FLAW 3: Nightly mysqldump backups are unencrypted because "TDE is on."
Chapter: 5 (and 8).
Fix: TDE encrypts the live database engine's own files/backups — it
does NOT automatically encrypt a separate mysqldump's plain-text SQL
output. Encrypt the dump independently, e.g. piping it through gpg
before it's ever written to disk unencrypted.

FLAW 4: The database still has its default sample schema.
Chapter: 9.
Fix: remove any default/sample databases and demo accounts — these are
publicly documented in the vendor's own materials and are among the
first things an attacker or automated scanner checks for.

OVERALL PATTERN: every one of these flaws is a case of assuming a
protection exists ("TDE covers our backups too," "the port opening is
temporary," "the sample database is harmless") rather than actually
verifying it — exactly what this chapter's test plan is meant to catch
before an incident does.