Exercise 1: Matching Investigation Actions to Their Source Chapter — Possible Solution
====================================================================

(a) Checking metrics before opening logs.
    -> CHAPTER 4 (Reading Logs & Metrics Under Pressure). Specifically
    the "First 5 Minutes of an Incident" material -- establishing
    scope (what changed, when, how widespread) via metrics BEFORE
    diving into log detail, which is exactly Step 2 of this chapter's
    own worked scenario.

(b) Using a request ID to trace across services.
    -> CHAPTER 4 as well -- the correlation-ID technique specifically,
    used in this chapter's own Step 4 to trace a failing request from
    the load balancer through the application servers to the
    database, filtering each service's logs down to just the relevant
    entries.

(c) Confirming this wasn't a provider-side issue via the health
    dashboard.
    -> CHAPTER 8 (Working With Cloud Provider Support). Specifically
    the account-specific health dashboard material -- checking it
    early (per Chapter 8's own tip-box) to distinguish a genuinely
    provider-side "of the cloud" issue (Chapter 1's shared
    responsibility model) from a customer-side one, which is exactly
    what this chapter's own Step 10 does.

WHY THIS WORKS AS AN ANSWER
------------------------------
Each action is matched to its specific originating chapter, and two of
the three ((a) and (b)) both come from Chapter 4 despite being
different techniques within it -- correctly recognizing that a single
chapter can contribute more than one distinct tool to a single
investigation, which is exactly what this capstone's own numbered
steps demonstrate happening in practice.