Exercise 1: Why Step 1 Checks %D First — Possible Solution
====================================================================

WHAT STEP 1 ACTUALLY CHECKS
------------------------------
Per this chapter, Step 1 confirms "is response time even being logged?"
by checking whether %D was added to the Apache LogFormat, before doing
anything else in the investigation.

WHY THIS COMES FIRST, PER CHAPTER 4
------------------------------
Chapter 4 established that "neither Common nor Combined Log Format
includes response time at all" - it has to be deliberately added via
%D/%T (Apache) or $request_time (Nginx). Without that configuration
already in place, the access log has no field at all to show how long
a request took - meaning any attempt to diagnose "slow" directly from
the access log would fail, not because nothing is wrong, but because
the data needed to answer the question was never being recorded in
the first place.

WHY THIS WALKTHROUGH CHECKS IT FIRST
------------------------------
Per this chapter, "Chapter 4's own prerequisite is already satisfied,
so the access log can actually answer a 'how slow' question." Checking
this first avoids wasting time trying to read timing data out of a log
that might not contain any - exactly the scenario Chapter 4's own
Exercise 1 covered directly.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly identifies what Step 1 checks, and correctly explains -
using Chapter 4's own established fact about default log formats - why
skipping this check could make the rest of the investigation
impossible before it even starts.