<a id="ch-08"></a>

## Chapter 8 — A second documentation range is still outside

<!-- open-cyber-academy:lesson-figures:start ch-08 -->
### Lesson map

Lesson 08. Map, example, EX054.

```mermaid
flowchart TD
  D["Both strings are documentation addresses"] --> T["The test is membership"]
  T --> Y["192.0.2.5 can pass"]
  T --> N["198.51.100.7 fails"]
```

Documentation status is not a column. The network object is the test.

### Logical drawing

```text
198.51.100.7
  not in the excluded set
  not in 192.0.2.0/25
verdict
  OUT OF SCOPE - do not test
```
<!-- open-cyber-academy:lesson-figures:end ch-08 -->

### Learning outcomes

After this chapter, you should be able to:

1. Say what the script compares `198.51.100.7` against.
2. Explain why "also a documentation address" does not make it in scope.
3. Refuse a print that treats every RFC 5737 address as allowed.

### 8.1 The allowed object is one network. A cousin range is a miss.

`198.51.100.7` parses as an address. It is not in the excluded set. It is also not inside `192.0.2.0/25`, which lives in `192.0.2.0/24`'s neighbourhood, not in `198.51.100.0/24`. Both the passing address and this one come from documentation ranges. The script never asks "is this documentation?" It asks the set, then the network list. The second answer is no, so the `else` assigns `OUT OF SCOPE - do not test`.

Maya's pack uses documentation addresses so a classroom example cannot be mistaken for a campus she can reach. That reason does not enlarge the network object. An address can be safe to write down and still be a forbidden target.

| Question the script asks | `192.0.2.5` | `198.51.100.7` |
|---|---|---|
| In the excluded set? | No | No |
| In `192.0.2.0/25`? | Yes | No |
| Printed verdict | `in scope` | `OUT OF SCOPE - do not test` |

### 8.2 Worked example

| Offered claim | What was tested | Decision |
|---|---|---|
| "Same RFC family, therefore allowed." | Family is not the predicate | Refuse |
| "The fourth line is a miss on the network test." | `else` after two false tests | Keep |
| "The script looked up a host name." | No name is stored | Refuse |

> **Synthetic case.** `198.51.100.7` is a string in `requested`. It is not a host the script contacts.

### Errors and limits

Do not add `198.51.100.0/24` to `in_scope` to make the fourth line pass.

### Apply

- **EX054 — Cousin range.** Why does `198.51.100.7` print `OUT OF SCOPE - do not test` even though it is a documentation address, like `192.0.2.5`? *Rubric:* 3 = the predicate is the excluded set, then `192.0.2.0/25`; this address fails both; documentation status is not a test;; 2 = it is outside the one allowed network;; 1 = one label;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-08 -->
### Continue studying — lesson 08 (chapter 08 of 20)

[← Chapter 07](#ch-07) · [Course chapter index](../SUBJECTS.md) · [Chapter 09 →](#ch-09)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex054"></a>
**EX054.** The tests are the excluded set and then `192.0.2.0/25`. This address fails both. Being a documentation address is not a test, which is why `192.0.2.5` can pass while this one does not.
