There has been an increase in Help Desk tickets related to web portal user accounts being locked out. Which of the following resources would be used to analyze the issue?

Router logs track routing decisions and network-layer traffic, not application-level user authentication events.

A protocol analyzer captures raw network packets in transit, which does not reveal application-specific account lockout records.

Firewall logs record allow or deny decisions for network connections, not individual user authentication or lockout events within a web application.

Application logs record authentication events such as failed login attempts, account lockouts, and session activity directly tied to the web portal. Because the issue is at the application layer, these logs contain the specific user account activity needed to diagnose why accounts are being locked out. Router and firewall logs operate at the network level and would not capture application-level authentication details.