PCAP Strings Practice Question
A QA engineer needs to verify that a user input string contains at least one uppercase letter, one lowercase letter, and one digit. Which regex pattern can be used with re.search() to achieve this?
⚠ Common exam trap
The PCAP exam often tests the distinction between character classes and lookahead assertions, trapping candidates who think a simple character class like [A-Za-z0-9] can enforce the presence of each type, when it only matches a single character from the union.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
r'(?=.*[A-Z])(?=.*[a-z])(?=.*\d)'
It uses lookahead assertions ((?=...)) to check for the presence of at least one uppercase letter, one lowercase letter, and one digit anywhere in the string, without consuming characters. This allows re.search() to return a match if all three conditions are met, regardless of order.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
r'(?=.*[A-Z])(?=.*[a-z])(?=.*\d)'
Why this is correct
This pattern uses three zero-width positive lookahead assertions evaluated from the same starting position. Each (?=...) checks that, from that position, .* can reach at least one uppercase letter, one lowercase letter, and one digit. Since lookaheads consume no characters, all three requirements are verified simultaneously and in any order, making the match succeed exactly when all categories appear somewhere in the string.
- ✗
r'[A-Za-z0-9]'
Why it's wrong here
This is a single character class that matches exactly one alphanumeric character, not a set of simultaneous conditions. When used with re.search, it returns a match as soon as any one letter or digit is found, so a string like 'ABC' passes even though it has no lowercase or digit, and 'password' passes with no uppercase or digit. It cannot assert that all three required categories coexist in the input.
- ✗
r'([A-Z].*[a-z].*\d)|([a-z].*[A-Z].*\d)|...'
Why it's wrong here
Each alternation branch hard-codes one particular relative order of the three required character classes, for example uppercase then lowercase then digit, or lowercase then uppercase then digit. Real user input can use any ordering, such as '1aB' or 'B1a', so any omitted permutation causes a valid string to fail. The approach is also unanchored and verbose, and the ellipsis in the pattern signals the author would need to enumerate all six permutations manually, which is far less robust than a lookahead-based check.
- ✗
r'\d.*[a-z].*[A-Z]'
Why it's wrong here
This concatenation enforces a strict chronological sequence: the first required character must be a digit, then, after any characters, a lowercase letter, then, after any characters, an uppercase letter. A valid string such as 'Ab1' has uppercase, lowercase, and digit in another order and is therefore rejected because the digit is not first. It fails for any permutation that does not fit exactly this left-to-right template, whereas the actual requirement is merely that each category appears somewhere in the string.
Go deeper
Related to this question
About these practice questions
This PCAP question is part of Courseiva's 169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCAP practice question is part of Courseiva's free Python Institute certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCAP exam.