200-201 Question 313
Single answerAs a junior cybersecurity analyst, you are tasked with creating a filter in a SIEM tool to identify log entries where IP addresses belong to the private Class A network (10.0.0.0/8). Which of the following regular expressions would correctly match these IP addresses?
- A
^10.\d{1,3}.\d{1,3}.\d{1,3}$
- B
^10.\d{1,2}.\d{1,3}.\d{1,3}$
- C
^10.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$
- D
10.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}
Show answer and explanation
Correct answer: A
Explanation
Regular expressions must be crafted carefully to match the desired pattern while avoiding unintended matches. In this case, the correct answer uses the start (^) and end ($) anchors to ensure it matches only valid IP addresses in the private Class A range (10.0.0.0/8). Additionally, the pattern '\d{1,3}' ensures each octet is represented as a valid number without exceeding the expected range.
- A. Correct.
This is the correct regular expression. It starts with '10.', allows for numbers between 0-255 in each octet using the pattern '\d{1,3}', and ensures the entire IP address matches by using the start (^) and end ($) anchors.
- B. Incorrect.
This option incorrectly uses '\d{1,2}' for the second octet, which would miss valid IPs like 10.100.0.1.
- C. Incorrect.
Although this option correctly matches the numbers in each octet, it lacks the start (^) and end ($) anchors, which could lead to incorrect matches within longer strings.
- D. Incorrect.
This option is missing the start (^) and end ($) anchors, meaning it could match '10.1.1.1' within a larger string such as 'my_ip_is_10.1.1.1'.