labs/Lab-2/Lab-2-Solution/01_Python_Basics_Solution.ipynb

Module 2 — Lab 1: Python Fundamentals for Security Analysis

Topics: variables, data types, strings, type casting, operators

Solution version: This notebook contains the complete solution. Run the cells in order and compare the results with your Lab notebook.

Learning objectives

After completing this lab, you will be able to:

• store security information in variables and select suitable data types;
• normalize log strings using string methods;
• cast values read from logs to the required data types;
• combine comparison and logical operators to flag suspicious activity.

In [ ]:

print("Hello, Cyber World!")

ip_address = "198.51.100.14"
port_number = 443
failed_logins = 7
response_time = 0.125
is_admin = False

print(f"IP: {ip_address} | Port: {port_number}")
print(type(ip_address), type(port_number), type(response_time), type(is_admin))

1. Strings in security logs

In [ ]:

log_message = "  FAILED login for Admin from 198.51.100.14  "
url = "https://example.com/login"

print(log_message.strip())
print(log_message.lower())
print(log_message.replace("FAILED", "DENIED"))
print(url[0:5])

2. Normalize a username and extract the protocol

In [ ]:

raw_username = "  AdMin "
normalized_username = raw_username.strip().lower()

url = "https://example.com/login"
protocol = url[0:5]

print(normalized_username)
print(protocol)

3. Type casting and operators

In [ ]:

port_text = "8080"
port_number = int(port_text)
next_port = port_number + 1

login_attempts = 7
user_ip = "198.51.100.14"
is_suspicious = login_attempts > 5 and user_ip != "127.0.0.1"

print(f"Next port: {next_port}")
print(f"Suspicious: {is_suspicious}")

4. Calculate a basic risk score

In [ ]:

failed_logins = 7
is_admin = False
is_off_hours = True

risk_score = failed_logins * 10 + int(is_admin) * 25 + int(is_off_hours) * 15
requires_review = risk_score >= 60

print(f"Risk score: {risk_score}")
print(f"Requires review: {requires_review}")

Self-check

In [ ]:

assert normalized_username == "admin"
assert protocol == "https"
assert next_port == 8081
assert is_suspicious is True
assert risk_score == 85
assert requires_review is True
print("✓ Lab 1 completed")

Reflection questions

1. Why does port_text + 1 fail while int(port_text) + 1 works?
2. What changes if you replace and with or in the is_suspicious condition?