312-39 · Question #27
The SOC team at CyberSecure Corp is conducting a security review to identify anomalous log entries from firewall logs. The team needs to extract patterns such as email addresses, IP addresses, and…
The correct answer is B. ([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3}). Hex color codes in common usage are represented as either 3 hex characters (shorthand) or 6 hex characters (full), typically composed of digits 0–9 and letters A–F (case-insensitive). Option B, ([A-Fa- f0-9]{6}|[A-Fa-f0-9]{3}), directly matches either a 6-character hex sequence…
Question
The SOC team at CyberSecure Corp is conducting a security review to identify anomalous log entries from firewall logs. The team needs to extract patterns such as email addresses, IP addresses, and URLs to detect unauthorized access attempts, phishing activities, and suspicious external communications. The SOC analyst applies various regular expressions (regex) patterns to filter and analyze logs efficiently. For example, they use \b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b to match IPv4 addresses. Which regex pattern should the SOC analyst use to extract all hexadecimal color codes found in the logs?
Options
- A(0[1-9]|1[0-2])/(0[1-9]|(1[0-2])/[0-9]|3[01])\d{4}
- B([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})
- C[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,}
- D\b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b
How the community answered
(39 responses)- A10% (4)
- B82% (32)
- C3% (1)
- D5% (2)
Explanation
Hex color codes in common usage are represented as either 3 hex characters (shorthand) or 6 hex characters (full), typically composed of digits 0–9 and letters A–F (case-insensitive). Option B, ([A-Fa- f0-9]{6}|[A-Fa-f0-9]{3}), directly matches either a 6-character hex sequence or a 3-character hex sequence and is the only option that targets hexadecimal character sets and lengths relevant to color codes. In SOC log parsing, regex is frequently used to extract structured tokens from semi-structured text logs so that fields can be normalized and queried. Option C is an email pattern, and option D is an IPv4 pattern. Option A appears to be a date-like pattern and is unrelated to hex. While many hex color codes are prefixed with “#”, this question’s option set focuses on the hex portion itself. In practice, analysts often refine such patterns to include boundaries or the “#” prefix depending on log content, but among the provided choices, B is the correct regex for extracting hexadecimal color
Topics
Community Discussion
No community discussion yet for this question.