Exercise 3: What Changes If the Engineer's Session Is Compromised — Possible Solution
====================================================================

UNDER THE BAD-PRACTICE APPROACH
------------------------------
In the "bad practice" column, the engineer holds a standing root shell
for the entire investigation and uses it for every step, including
database checks that never needed write access at all. Per this
chapter's warn-box reasoning, if this session were compromised at any
point during the investigation, "the attacker inherits full admin
access, not just the read access the task actually needed" - the
compromise grants the attacker everything the root account can do,
regardless of what the engineer was actually doing at that moment.

UNDER THE GOOD-PRACTICE APPROACH
------------------------------
In the "good practice" column, the engineer connects with a standard
account, uses a dedicated read-only database role for the diagnostic
queries, and reaches for sudo only for the one specific command that
genuinely needs elevation. If this session were compromised during most
of the investigation (while running read-only checks), the attacker
would only inherit read-only access - the standard account and the
read-only role - not full administrative control. Only if the
compromise happened during the brief, specific moment sudo was actually
invoked would elevated access be at risk, and even then it's scoped to
that one command's own privilege, not a standing elevated shell.

WHY THE DIFFERENCE IS ABOUT DURATION AND SCOPE OF EXPOSURE
------------------------------
The bad-practice approach exposes full admin privilege for the entire
duration of the investigation, regardless of what specific step is
being performed at any given moment. The good-practice approach
confines the highest privilege level to the narrowest possible window
- the single command that actually needs it - dramatically shrinking
both how long and how much privilege is exposed to a potential
compromise at any given point in time.

WHY THIS WORKS AS AN ANSWER
------------------------------
It applies the chapter's own compromise scenario separately to each
column of the comparison table, explaining specifically what privilege
level an attacker would inherit under each approach and why the
difference comes down to the duration and scope of exposure.