PCAP Strings Practice Question
A developer needs to parse a log file where each line contains a timestamp followed by a message. The timestamp format is 'YYYY-MM-DD HH:MM:SS'. Which string method is most appropriate to split the timestamp from the message?
⚠ Common exam trap
Python Institute often tests the distinction between str.split() and str.partition(), where candidates mistakenly choose str.partition() because they think it splits on the first space, but fail to realize that the timestamp itself contains a space, causing an incorrect split.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
str.split()
Str.split(), is the most appropriate because it splits a string on whitespace by default. Although the timestamp 'YYYY-MM-DD HH:MM:SS' contains a space, using split() without arguments returns a list of all space-separated elements. Since the timestamp is always the first two elements (date and time), the developer can join them with a space to get the full timestamp. Alternatively, split() can be used with a specified separator and maxsplit to achieve the desired split. This flexibility makes str.split() the best choice among the given options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
str.rsplit()
Why it's wrong here
str.rsplit() processes the string from the right, which is the opposite of what this parsing task requires. If the log line contains multiple whitespace-separated fields, calling rsplit() without a maxsplit would split off the message words first, leaving the timestamp attached to the final chunk of the prefix. The timestamp is the first field, so you need left-to-right splitting; rsplit() would require an awkward maxsplit argument and careful reconstruction to isolate the leading token.
- ✗
str.splitlines()
Why it's wrong here
str.splitlines() is designed to split on line boundaries such as newline, carriage return, or Unicode line separators, not on spaces within a single line. When applied to one log line, it returns a list with the whole line as a single element unless there are actual embedded newlines, so it cannot separate the timestamp from the message. It is therefore irrelevant for parsing fields that are separated by ordinary whitespace inside a line.
- ✗
str.partition()
Why it's wrong here
str.partition(sep) splits the string into a 3-tuple: everything before the first occurrence of sep, sep, and everything after it. If you pass a single space, the timestamp comes out cleanly only when exactly one space separates it from the message; with multiple spaces, the tail begins with extra spaces, and you still need to strip or further process it. It also stops after the first separator, so it does not handle repeated or variable whitespace as robustly as split() does, making it a less appropriate choice for general log parsing.
- ✓
str.split()
Why this is correct
str.split() with no arguments splits on any run of whitespace, trimming leading and trailing spaces, and returns a list of non-empty substrings. For a log line like '2025-04-10 14:22:31 INFO message here', the timestamp (which contains no spaces) becomes the first element while the rest of the line is broken into subsequent elements, cleanly isolating the timestamp. It is the most direct method because it handles variable amounts of whitespace without requiring a separator to be specified.
Go deeper
Related to this question
About these practice questions
One of 169 original PCAP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCAP practice question is part of Courseiva's free Python Institute certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCAP exam.