Exercise 3: Why "Strong Password" Doesn't Justify Public Exposure — Possible Solution
====================================================================

This reasoning conflates two entirely separate layers of defense that
this chapter treats as independent: WHETHER the database can be
reached at all (the network layer, this chapter) and WHETHER a
connection, once reached, can authenticate (Chapter 2). A strong
password only helps with the second — it does nothing to address the
first.

WHAT'S WRONG WITH IT, SPECIFICALLY:

1. Exposing the port publicly means the database is discoverable by
   automated internet-wide scanners "within minutes to hours," per
   this chapter's warning box — a strong password doesn't stop the
   database from being FOUND, it only (hopefully) stops it from being
   broken into once found. That still means every scanner and
   opportunistic attacker on the internet now knows this database
   exists and can keep probing it indefinitely.

2. A strong password today doesn't guarantee no vulnerability, bug, or
   misconfiguration in that same authentication path is ever
   discovered later. An exposed port turns any FUTURE authentication
   weakness (a bug in the database engine itself, a leaked credential
   from an unrelated incident, a brute-force attempt against a
   password that seemed strong at the time) into something the whole
   internet has a live opportunity to exploit immediately, rather than
   only entities already inside the private network.

3. It removes an entirely free, independent layer of protection for
   zero real benefit — the "convenience" being traded away is nothing
   more than avoiding the small one-time setup cost of a bastion host
   or VPN. There's no genuine functional reason a public database port
   makes anything easier that a properly tunneled private connection
   doesn't also achieve.

The correct framing: authentication strength and network exposure are
two SEPARATE, INDEPENDENT layers of defense — a strong password is
good, but it's not a substitute for the network layer being locked
down too, exactly the "defense in depth" principle Chapter 3 already
established for least privilege.