Challenge 3: A Single-IP Deny Inside an Allowed Subnet -- Solution
Walkthrough

The answer: the request from 203.0.113.50 will be denied.

Why: ipSecurity entries are not evaluated strictly top-to-bottom --
the most specific matching rule wins, regardless of the order the
entries are listed in. 203.0.113.50 as a single-IP entry (an implicit
/32) is more specific than the 203.0.113.0/24 subnet rule, even
though 203.0.113.50 numerically falls inside that subnet's own
range. Because the single-IP rule explicitly sets allowed="false"
for that one address, it takes precedence over the broader subnet
rule that would otherwise have allowed it. allowUnlisted="false"
never even comes into play here, since 203.0.113.50 matches an
explicit entry -- that setting only determines the outcome for an IP
that matches nothing listed at all.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader knows ipSecurity's real
evaluation rule (most-specific-match-wins) rather than assuming a
simple first-match-in-listed-order model, and can correctly apply it
to a case where a broader "allow" and a narrower "deny" both
technically match the same address.