Exercise 1: TLS Still Matters on a Private Network — Possible Solution
====================================================================

Chapter 4's private-network restriction and this chapter's TLS solve
two DIFFERENT problems, even though both apply to the same connection.

Chapter 4 controls WHO CAN EVEN ATTEMPT a connection — restricting the
database's reachability to specific allowlisted hosts (application
servers, a bastion host) instead of the entire internet. But once a
connection between two ALLOWED hosts is happening, that traffic still
physically crosses real infrastructure: network switches, routers, and
— especially relevant in a cloud environment — a shared hypervisor
layer that other, unrelated tenants' virtual machines also run on.
"Private network" describes an access-control boundary, not a
guarantee that literally nothing else can ever observe traffic
crossing that network.

TLS protects the connection ITSELF, regardless of who was allowed to
initiate it — even between two hosts that were both legitimately
permitted to talk to each other, an unencrypted connection is still
readable in plaintext to anything positioned to observe that traffic
in between (a compromised intermediate host, a misconfigured piece of
shared infrastructure, or an insider already present somewhere on that
same private network, per Chapter 1's insider-threat category).

The two layers are complementary, not redundant: Chapter 4 narrows who
gets a chance to see any traffic at all; this chapter protects the
actual contents of that traffic even from whatever narrow set of
positions Chapter 4 didn't (or couldn't) fully rule out.