ExamGecko
Question list
Search
Search

List of questions

Search

Question 3 - SPLK-1005 discussion

Report
Export

The following sample log event shows evidence of credit card numbers being present in the transactions. loc file.

Which of these SEDCM3 settings will mask this and other suspected credit card numbers with an Y character for each character being masked? The indexed event should be formatted as follows:

A)

B)

C)

D)

A.

Option A

Answers
A.

Option A

B.

Option B

Answers
B.

Option B

C.

Option C

Answers
C.

Option C

D.

Option D

Answers
D.

Option D

Suggested answer: A

Explanation:

The correct SEDCMD setting to mask the credit card numbers, ensuring that the masked version replaces each digit with an 'x' character, is Option A.

The SEDCMD syntax works as follows:

s/ starts the substitute command.

(?cc_num=\d{7})\d{9}/ matches the specific pattern of the credit card number in the logs.

\1xxxxxxxxx replaces the matched portion with the first captured group (the first 7 digits of the cc_num), followed by 9 'x' characters to mask the remaining digits.

/g ensures that the substitution is applied globally, throughout the string.

Thus, Option A correctly implements this requirement.

Splunk Documentation

Reference: SEDCMD for Masking Data

asked 10/10/2024
Herr Alexandre Fleider
39 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first