Exercise 2: fail2ban IP Ban vs. Account Lockout — Possible Solution
====================================================================

THE DIFFERENCE BETWEEN THE TWO
------------------------------
Per this chapter, fail2ban operates at the IP/network level - it
"watches logs... for repeated failed attempts and automatically
firewalls off the offending IP for a period of time," meaning ALL
requests from that IP are blocked, regardless of which account they're
trying to log into. An account lockout, by contrast, is described as
"a deliberate security feature after too many failed attempts on one
specific account" - it blocks that one account regardless of which IP
address is used to attempt it. One blocks by source, the other blocks
by destination account.

WHY CHECKING APPLICATION LOGS FIRST IS THE WRONG ORDER FOR fail2ban
------------------------------
Per this chapter's own layered model, fail2ban operates at "Layer 2:
Blocked Before the Application" - once an IP is banned, "later requests
are rejected at the firewall - before Apache or Nginx ever sees them,
meaning they won't appear in the access log either." Since the request
never reaches the application at all once banned, the application's
own logs (Layer 3) have nothing to show - checking them first would be
searching a log that was never going to contain the relevant evidence,
exactly the general "working outside-in matters" point this chapter
makes about layer order.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly distinguishes IP-level blocking (fail2ban) from account-
level blocking (lockout), and correctly explains why application logs
specifically can't help diagnose a fail2ban ban, since a banned
request never reaches the layer that log records.