Exercise 3: Reading the Office/VPN/Home Pattern — Possible Solution
====================================================================

WHAT THE PATTERN POINTS TO
------------------------------
Per this chapter's worked example, the port opens successfully from
the office LAN and over the corporate VPN, but times out every time
from a direct home connection with no VPN. This chapter states this
"points precisely at a boundary rule that permits traffic from the
office network and the VPN's own address range, but not from the
general internet - consistent with a port-specific, source-scoped
firewall rule."

WHY IT NARROWS TO A SOURCE-SCOPED RULE SPECIFICALLY
------------------------------
The port works from two of the three tested vantage points and only
fails from the one lacking either an office or VPN source address -
per this chapter's own multiple-vantage-point technique, this pattern
rules out the service itself being broken (it demonstrably works for
some sources) and instead implicates a rule that filters based on
where the traffic originates.

WHY THIS MIGHT NOT BE A BUG AT ALL
------------------------------
Per this chapter, "this could be a genuine misconfiguration, or it
could be entirely intentional access control - this app may simply
have never been meant to be reachable without the VPN." A boundary
rule that only allows office/VPN sources could be a deliberate security
decision (limiting an internal reporting app to trusted network
sources), not an accident.

WHY CONFIRMING BEFORE "FIXING" MATTERS
------------------------------
Per this chapter, "the right next step is confirming which one it is
with whoever owns that access policy, not assuming either answer and
proceeding to 'fix' something that might not be broken at all." Opening
the rule up without checking could actually remove an intentional
security control rather than fix a genuine bug.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly identifies the source-scoped firewall rule as the
technical finding, and separately explains the chapter's own explicit
caution that this pattern is equally consistent with intended
behavior, not just a bug - rather than assuming a fix is automatically
needed.