BTechibtechi.in
Loading Loading
Free IIT Madras BS notes, PYQs and mock tests at btechi.in

TDS · Apache log parsing & filtering

42 questions · 45 marks · 4 papers

Answer key

Indian Institute of Technology Madras

BS Degree Programme · Examination & Study Paper

Tools in Data Science

Apache log parsing & filtering

Official Paper

Examination Instructions & Guidelines

Solve on notebook/paper first before checking solutions.
MCQ: Exactly 1 option is correct. Negative marking applies.
MSQ: One or more options correct. Select all to score.
Scientific calculator allowed for all calculations.
Official answer key is sealed at the end of this sheet.

End Term · 31 Aug 2025 (FN)End Term

Read the passage below, then answer Q1–Q10
Scenario 3: E-commerce Platform Log Analysis
You're analyzing Apache access logs from a major e-commerce platform. The logs contain customer browsing patterns, purchase behaviors, and system performance metrics during Black Friday sales.
Log Format Specification:
Analysis Requirements:
● Filter purchases (POST to /checkout/) during peak hours (12:00-15:59)
● Identify mobile vs desktop traffic patterns
● Track successful transactions (status codes 200-299)
● Analyze product category performance
Based on the above data, answer the given subquestions.
Q1MCQ1 Mark·Choose one option
Asked 4 times Key ↓
Which of the following Apache log entries correctly represents a successful mobile checkout transaction that occurred during the peak analysis window (12:00–15:59)?
1. A
2. B
3. C
4. D
Q2MCQ1 Mark·Choose one option
Asked 4 times Key ↓
To extract essential fields for the analysis "mobile checkout transactions between 12:00-15:59 with successful status codes", which data elements are required?
1. AIP, UserAgent, Referrer, VirtualHost
2. BTimestamp, HTTP_METHOD, URL, StatusCode, UserAgent
3. CRemoteUser, AuthUser, ResponseSize, ServerIP
4. DIP, Timestamp, Referrer, ResponseSize
Q3MCQ1 Mark·Choose one option
Asked 4 times Key ↓
1. A%d/%b/%Y:%H:%M:%S
2. B%d/%b/%Y:%H:%M:%S %z
3. C%Y-%m-%d %H:%M:%S %Z
4. D%d-%b-%Y:%H:%M:%S GMT
Q4MCQ1 Mark·Choose one option
Asked 4 times Key ↓
To identify checkout transactions occurring between 12:00 and 15:59, which Python condition correctly validates the time range?
1. A
2. B
3. C
4. D
Q5MCQ1 Mark·Choose one option
Asked 3 times Key ↓
1. A
2. B
3. C
4. D
Q6MCQ1 Mark·Choose one option
Asked 2 times Key ↓
To identify mobile traffic from the UserAgent string, which Python approach provides the most reliable mobile device detection?
1. A
2. B
3. C
4. D
Q7MCQ1 Mark·Choose one option
Asked 4 times Key ↓
For determining successful transactions, which condition correctly identifies HTTP status codes indicating success?
1. A
2. B
3. C
4. D
Q8MCQ1 Mark·Choose one option
Asked 2 times Key ↓
1. A
2. B
3. C
4. D
Q9MCQ1 Mark·Choose one option
Asked 4 times Key ↓
If the transaction count appears unexpectedly high, which systematic debugging approach would identify the root cause?
1. AAssume data corruption and discard results
2. BValidate each filter condition independently: time range → HTTP method → URL pattern → status code
3. CReduce the dataset size randomly
4. DCheck only the timestamp filter
Q10MCQ1 Mark·Choose one option
Asked 2 times Key ↓
When processing very large Apache log files (10GB+), which of the following Python approaches offers the best memory efficiency?
1. A
2. B
3. C
4. D

End Term · 31 Aug 2025 (AN)End Term

Read the passage below, then answer Q11–Q20
Scenario 3: Gaming Platform User Behavior Analysis
You're analyzing server logs from a multiplayer gaming platform during a major tournament event. The logs contain player actions, performance metrics, and system resource utilization data.
Analysis Requirements:
●Filter competitive gaming actions (kills, deaths, objectives) during tournament hours (14:00- 20:59)
●Differentiate between PC and console gaming patterns
●Track successful game events (status codes 200-299)
●Analyze player performance across different game modes
Based on the above data, answer the given subquestions.
Q11MCQ1 Mark·Choose one option
Asked 4 times Key ↓
Which log entry correctly represents a successful console objective action during the tournament window?
1. A
2. B
3. C
4. D
Q12MCQ1 Mark·Choose one option
Asked 4 times Key ↓
For analyzing "competitive gaming actions during tournament hours with successful responses", which log fields are essential?
1. APlayerIP, PlayerID, Platform, MatchID
2. BTimestamp, ACTION, GameMode, StatusCode, ActionType
3. CPlayerID, ResponseTime, UserAgent, Level
4. DPlayerIP, Timestamp, Platform, ResponseTime
Q13MCQ1 Mark·Choose one option
Asked 4 times Key ↓
1. A
2. B
3. C
4. D
Q14MCQ1 Mark·Choose one option
Asked 4 times Key ↓
To filter gaming actions between 14:00 and 20:59 tournament hours, which condition correctly validates the time range?
1. A
2. B
3. C
4. D
Q15MCQ1 Mark·Choose one option
Asked 3 times Key ↓
1. A
2. B
3. C
4. D
Q16MCQ1 Mark·Choose one option
Asked 2 times Key ↓
Which approach most accurately identifies console gaming platforms from the Platform field?
1. A
2. B
3. C
4. D
Q17MCQ1 Mark·Choose one option
Asked 4 times Key ↓
For identifying successful gaming events, which status code condition is most appropriate?
1. A
2. B
3. C
4. D
Q18MCQ1 Mark·Choose one option
Asked 2 times Key ↓
To efficiently count different action types (KILL, DEATH, OBJECTIVE) from filtered tournament data, which approach is optimal?
1. A
2. B
3. C
4. D
Q19MCQ1 Mark·Choose one option
Asked 4 times Key ↓
If tournament action counts appear inconsistently high, which systematic debugging approach identifies the issue?
1. AAssume tournament data corruption and exclude results
2. BValidate each filter systematically: time range → game mode → action type → status codes → platform detection
3. CReduce dataset randomly and extrapolate
4. DFocus only on successful status codes
Q20MCQ1 Mark·Choose one option
Asked 2 times Key ↓
For processing massive gaming log files (100GB+) with memory constraints, which Python approach provides optimal performance?
1. A
2. B
3. C
4. D

End Term · 13 Apr 2025 (FN)End Term

Read the passage below, then answer Q21–Q31
Scenario 3
You are provided with a Gzipped Apache log file from a website having the below data in each row.
The fields are separated by spaces and quoted by double quotes ("). Unlike CSV files, quoted fields are escaped via "and not". All data is in the GMT-0500 timezone and the questions were based in this same time zone.
Use the information given and answer the sub-questions.
Note: Assume that you are using Python codes for log analysis
Q21MCQ2 Marks·Choose one option
Asked 4 times Key ↓
Which of the following is a valid log entry based on the provided format?
1. A192.168.1.1 - - [12/Dec/2024:14:05:59 -0500] "GET /image.jpg HTTP/1.1" 200 1234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" www.s-anand.net 192.254.190.217
2. B192.168.1.1 - - [12/Dec/2024:14:05:59 -0500] "POST /image.jpg INVALID" 200 1234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" www.s-anand.net 192.254.190.217
3. C192.168.1.1 - - [12/Dec/2024:14:05:59 -0500] "PUT /image.jpg HTTP/1.1" OK 1234 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" www.s-anand.net 192.254.190.217
4. D203.0.113.7 - - [14/Dec/2024:16:45:11 -0500] "GET /index.html HTTP/1.1" 200 3500 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36" www.s-anand.net 192.254.190.219
Q22MCQ1 Mark·Choose one option
Asked 4 times Key ↓
Which of the following fields are necessary to filter "POST requests made for pages under /images/ from 15:00 to 18:00 on Mondays"?
1. ATime, Request, Method, URL
2. BTime, Method, Status, Size
3. CTime, Method, URL, Referer
4. DTime, Status, URL, Server
Q23MCQ1 Mark·Choose one option
Asked 4 times Key ↓
If the time in the log is stored in the format [01/May/2024:00:00:00 -0500], which of the following time formats should you use to parse it correctly?
1. A
2. B
3. C
4. D
Q24MCQ2 Marks·Choose one option
Asked 2 times Key ↓
Which of the following methods is best for identifying if a log entry’s timestamp corresponds to a Sunday?
1. ACheck if timestamp.dayname() == 'Sunday'
2. BCheck if timestamp.weekday() == 5
3. CCheck if timestamp.strftime('%A') == 'Sunday'
4. DCheck if timestamp.weekday() == 6
Q25MCQ1 Mark·Choose one option
Asked 4 times Key ↓
How would you identify log entries where the time is between 16:00 and 18:59 on Sundays?
1. ACheck if 16 <= timestamp.hour < 18
2. BCheck if 16 <= timestamp.hour < 19
3. CCheck if 16 < timestamp.hour < 19
4. DCheck if timestamp.hour in range(16, 20)
Q26MCQ1 Mark·Choose one option
Asked 3 times Key ↓
How would you extract the HTTP protocol version (e.g., HTTP/1.1) from the Request field "GET /blog/ HTTP/1.1"?
1. AUse request.split('/')[1]
2. BUse request.split(' ')[2]
3. CUse request.split(' ')[1]
4. DUse request.split('/')[2]
Q27MCQ1 Mark·Choose one option
Asked 3 times Key ↓
1. A
2. B
3. C
4. D
Q28MCQ1 Mark·Choose one option
Asked 2 times Key ↓
1. A
2. B
3. C
4. D
Q29MCQ1 Mark·Choose one option
Asked 4 times Key ↓
How would you identify if the log entry’s HTTP status code indicates a redirection request? (Assume that status is correctly stored in the variable ‘status’)
1. Astatus in [301, 302, 303]
2. B200 < status < 400
3. C300 <= status < 400
4. Dstatus in range(299, 400)
Q30MCQ1 Mark·Choose one option
Asked 2 times Key ↓
After filtering the log entries (in a list filtered_entries), which of the following is the best way to count the number of requests with a 404 status code for pages under /error/?
1. AUse len(filtered_entries)
2. BUse len(entries)
3. CUse sum(1 for entry in entries)
4. DNone of these
Q31MCQ1 Mark·Choose one option
Asked 4 times Key ↓
If the count of log entries appears much larger than expected, which of the following could be the reason?
1. AThe filter for Monday is incorrect.
2. BThe filter for time range is incorrect.
3. CThe filter for HTTP method is incorrect.
4. DAny of these could be the reason.

End Term · 22 Dec 2024 (FN)End Term

Read the passage below, then answer Q32–Q42
Q32MSQ2 Marks·Choose all correct options
Asked 4 times Key ↓
Which of the below can be a valid log file entry based on the descriptions provided in the main question?
1. A40.77.167.48 - - [30/Apr/2024:07:12:09 -0500] "GET /mplayer2.jsz HTTP/1.1" 200 7416 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" www.s-anand.net 192.254.190.216
2. B40.77.167.48 - - [30/Apr/2024:07:12:09 -0500] "POST /mplayer2.jsz HTTP/1.1" 200 7416 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" www.s-anand.net 192.254.190.216
3. C40.77.167.48 - - [30-Apr-2024 07:12:09 -0500] "GET /mplayer2.jsz HTTP/1.1" 200 7416 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" www.s-anand.net 192.254.190.216
4. D40.77.167.48 - - [30/Apr/2024:07:12:09 -0500] "GET /mplayer2.jsz HTTP/1.1" OK 7416 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36" www.s-anand.net 192.254.190.216
Q33MCQ1 Mark·Choose one option
Asked 4 times Key ↓
Which of the following fields are necessary to filter "GET requests made for pages under /telugump3/ from 10:00 until before 21:00 on Saturdays"?
1. ATime, Request, URL, Method
2. BTime, Request, Status, Size
3. CTime, Method, URL, Status
4. DTime, Status, URL, Referer
Q34MCQ1 Mark·Choose one option
Asked 4 times Key ↓
1. A
2. B
3. C
4. D
Q35MCQ1 Mark·Choose one option
Asked 2 times Key ↓
Which of the following methods is best for identifying if a log entry's timestamp corresponds to a Saturday? (timestamp is a method in datetime library)
1. A
2. B
3. C
4. D
Q36MSQ1 Mark·Choose all correct options
Asked 4 times Key ↓
How would you identify log entries where the time is between 10:00 and 20:59 on Saturdays?
1. A
2. B
3. C
4. D
Q37MCQ1 Mark·Choose one option
Asked 3 times Key ↓
1. A
2. B
3. C
4. D
Q38MCQ1 Mark·Choose one option
Asked 3 times Key ↓
1. A
2. B
3. C
4. D
Q39MCQ1 Mark·Choose one option
Asked 2 times Key ↓
1. A
2. B
3. C
4. D
Q40MCQ1 Mark·Choose one option
Asked 4 times Key ↓
How would you identify if the Status code of a log entry indicates a successful request? (Assume that status is correctly stored in the variable ‘status’)
1. A
2. B
3. C
4. D
Q41MCQ1 Mark·Choose one option
Asked 2 times Key ↓
1. A
2. B
3. C
4. D
Q42MCQ1 Mark·Choose one option
Asked 4 times Key ↓
If the count of log entries appears much smaller than expected, which of the following could be the reason?
1. AThe filter for Saturday is incorrect.
2. BThe filter for time range is incorrect.
3. CThe filter for successful status codes is incorrect.
4. DAny of the given option could be the reason.

Official Key

Master Answer Key & Explanations

Official answer keys from IIT Madras BS past papers. Click any question to review.

Reveal Key

Q1A

Q2B

Q3B

Q4C

Q5B

Q6B

Q7C

Q8B

Q9B

Q10B

Q11A

Q12B

Q13B

Q14B

Q15A

Q16B

Q17C

Q18B

Q19B

Q20B

Q21D

Q22A

Q23A

Q24D

Q25B

Q26B

Q27A

Q28B

Q29C

Q30D

Q31D

Q32A, B

Q33C

Q34A

Q35B

Q36A, D

Q37A

Q38A

Q39B

Q40A

Q41A

Q42D

Questions and answer keys are reproduced from the official IIT Madras BS papers. Topics and repeated question types are BTechi’s own grouping. BTechi is not affiliated with IIT Madras.