Exercise 1: An Error-or-Worse Query for backup-agent — Possible Solution
====================================================================

journalctl -u backup-agent -p err -b

Explanation:

This follows the chapter's own exact combined-query pattern
(journalctl -u myapp -p err -b), just with the unit name swapped for
backup-agent per the exercise's own requirement. -u backup-agent
narrows the query down to only this specific unit's own log entries,
exactly as -u myapp did in the chapter's own example. -p err filters
to entries at error severity OR WORSE (crit, alert, emerg included, per
the chapter's own ordered-scale explanation), rather than only entries
tagged exactly "err." -b restricts the results to the current boot
only, excluding anything logged during a previous boot session. All
three flags combine into one query narrowing along three independent
dimensions at once (which unit, which severity, which time window)
-- exactly the "real, targeted incident-response query" shape the
chapter's own tip-box describes.

WHY THIS WORKS AS AN ANSWER
------------------------------
This reproduces the chapter's own established combined-flag pattern
correctly, with the unit name substituted per the exercise, and
explains what each of the three flags individually narrows down
rather than treating the combined command as an unexplained recipe.