Exercise 3: Using a PID to Connect a Crash to an Earlier Resource Spike — Possible Solution
====================================================================

WHAT THE PID PROVIDES, PER CHAPTER 1
------------------------------
Chapter 1 established the PID as the identifier that lets different
tools "talk about the same running process" - Task Manager's Details
tab exposes it, and it's "the exact identifier needed to cross-reference
the same process in Resource Monitor or Event Viewer."

HOW THIS APPLIES TO A CRASH ENTRY IN EVENT VIEWER
------------------------------
Many Event Viewer entries for an application crash or error include the
PID of the process involved, either directly in the event's own
description or in its structured XML detail (accessible via "Copy
Details as XML," per this chapter's own tip-box). That PID is the same
identifier Task Manager and Resource Monitor use for that same process.

CONNECTING IT TO AN EARLIER RESOURCE SPIKE
------------------------------
If Resource Monitor had shown a resource-usage spike (high CPU, memory,
or disk activity) for a specific PID a few minutes before the crash,
noting that same PID from the Event Viewer crash entry and confirming
it matches the PID that spiked earlier ties the two observations
together as almost certainly the same underlying event - the process
that spiked is very likely the same one that later crashed, rather than
two unrelated coincidences.

WHY THIS IS EXACTLY THE WORKFLOW THIS CHAPTER DESCRIBES
------------------------------
Per this chapter's own finding-box, "start from the clearest, most
specific error..., note its exact timestamp and any PID mentioned, then
filter... to a narrow window around that same timestamp... to see what
else was happening at the same moment." Matching the PID between the
Event Viewer crash entry and an earlier Resource Monitor observation is
a direct, concrete instance of that same "note the PID, look at the
surrounding window" correlation process, connecting a live-tool
observation (Resource Monitor) to a historical log entry (Event Viewer)
via the one identifier both tools share.

WHY THIS WORKS AS AN ANSWER
------------------------------
It restates what a PID actually enables per Chapter 1, explains
concretely how that same PID would appear in an Event Viewer crash
entry, and ties the connection directly back to this chapter's own
described correlation workflow rather than treating the two
observations as separate pieces of evidence.