<a id="ch-06"></a>

## Chapter 6 — Exclusion is the first branch

<!-- open-cyber-academy:lesson-figures:start ch-06 -->
### Lesson map

Lesson 06. Map, example, EX052.

```mermaid
flowchart TD
  A["ip_address of this string"] --> B{"In the excluded set?"}
  B -->|Yes| E["EXCLUDED - do not test"]
  B -->|No| C{"Inside 192.0.2.0/25?"}
  C -->|Yes| I["in scope"]
  C -->|No| O["OUT OF SCOPE - do not test"]
```

The set test runs before the network test. `.10` never reaches the second test.

### Logical drawing

```text
192.0.2.10 is inside the /25
and inside the excluded set
first true branch
  EXCLUDED - do not test
the elif is not evaluated
```
<!-- open-cyber-academy:lesson-figures:end ch-06 -->

### Learning outcomes

After this chapter, you should be able to:

1. Say which test runs first.
2. Explain why membership in the `/25` does not save `.10`.
3. Refuse a reading that calls the exclusion a script bug.

### 6.1 `if` then `elif`. The first true branch wins.

The excluded object is a set with one member, `192.0.2.10`. The allowed object is a list with one network, `192.0.2.0/25`. For each string, `ip_address` builds an address, then the `if` asks whether that address is in the set. Only if that test is false does the `elif` ask whether the address sits in any network in the list.

`192.0.2.10` makes the set test true. Python skips the `elif`. The network object still contains that address; the branch structure is what keeps the verdict at `EXCLUDED - do not test`. Reversing the two tests would be a different program. This file does not reverse them.

| Address | In the set? | In the `/25`? | Branch that runs |
|---|---|---|---|
| `192.0.2.5` | No | Yes | `elif` → `in scope` |
| `192.0.2.10` | Yes | Yes, unused | `if` → `EXCLUDED` |
| `192.0.2.130` | No | No | `else` |
| `198.51.100.7` | No | No | `else` |

### 6.2 Worked example

| Offered claim | What the branch does | Decision |
|---|---|---|
| "Payroll is excluded because the owner said so, and the `if` encodes that." | Set test first | Keep |
| "`.10` is in the range, so the range line should win." | The `elif` does not run | Refuse |
| "The set removes `.10` from the network object." | The network is unchanged | Refuse |

> **Synthetic case.** The payroll server is a label in a comment. The set holds the address.

### Errors and limits

Do not treat "inside the range" as permission when the set test is true.

### Apply

- **EX052 — First branch.** `192.0.2.10` is inside `192.0.2.0/25` and inside the excluded set. Which test decides the printed verdict, and does the other test still get evaluated? *Rubric:* 3 = the set test is first and true; the `elif` is skipped; the verdict is `EXCLUDED - do not test`;; 2 = exclusion wins and the range does not override it;; 1 = one fact;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-06 -->
### Continue studying — lesson 06 (chapter 06 of 20)

[← Chapter 05](#ch-05) · [Course chapter index](../SUBJECTS.md) · [Chapter 07 →](#ch-07)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex052"></a>
**EX052.** The set test is first and true, so the `elif` does not run. The verdict is `EXCLUDED - do not test`. The network object still contains the address.