Exercise 1: Bind Addresses Explained — Possible Solution
====================================================================

127.0.0.1 (localhost) — the database only accepts connections
originating from the SAME machine it's running on. Nothing on any
other machine, private or public, can reach it at all through the
network — the only way to connect is a process running locally.

A private network IP (e.g. a VPC-internal address like 10.0.1.5) — the
database accepts connections from other machines that share that same
private network, but remains completely unreachable from the public
internet. This is the right choice when the application and database
run on separate machines that are still both inside the same private
network/VPC.

0.0.0.0 — the database listens on EVERY network interface the machine
has, including any public-facing one. This is the one that makes a
database reachable from the public internet, ASSUMING the machine
itself has a public IP and no firewall blocks the port — 0.0.0.0 on its
own is a necessary condition for public exposure, though a firewall
rule (Chapter 4's own next section) can still block outside access even
when bound this broadly. The safest default is still never binding to
0.0.0.0 unless there's a specific, understood reason to, with a
firewall as a second, independent layer regardless.