Analysis of Competing Hypotheses TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is conducting an ACH analysis on a series of data exfiltration events. The analyst has generated four hypotheses and is now collecting evidence. However, the analyst has a strong personal belief that the exfiltration is the work of a specific APT group. This belief influences which evidence the analyst considers relevant and how it is interpreted. What is the most effective way to mitigate this bias?

   • AUse a computer algorithm to automatically build the matrix without human input.
   • BRemove the APT hypothesis from the set to avoid bias.
   • CHave another analyst independently review the evidence selection and matrix construction.
   • DOnly include evidence that is objective, such as logs, and exclude subjective evidence.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are leading an ACH session for a new threat campaign. The team has just generated a list of hypotheses and is about to evaluate evidence. According to the ACH process, what should happen immediately after the hypotheses are identified?

   • ARefute hypotheses that seem unlikely
   • BPresent the conclusions to stakeholders
   • CBuild the matrix and fill in consistency ratings
   • DList all significant evidence and arguments relevant to the hypotheses
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   Your ACH matrix ranks Hypothesis A as most likely, but you are concerned because the ranking depends heavily on the assumption that the 'attacker's IP address is not a proxy' is reliable. You have doubts about this assumption. What is the best way to handle this uncertainty in your analysis?

   • AChange the hypothesis set to make the IP address less important
   • BPerform a sensitivity analysis by re-rating the evidence under different assumptions about the IP address
   • CRemove the IP address evidence from the matrix to avoid bias
   • DIgnore the uncertainty because the IP address is the only evidence you have
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is building an ACH matrix and includes only evidence that supports the hypothesis they believe is correct, while excluding evidence that contradicts it. Which ACH pitfall is this analyst committing?

   • AOverly complex matrix
   • BIncomplete hypothesis set
   • CBiased evidence selection
   • DFailure to perform sensitivity analysis
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A threat intelligence analyst is investigating a series of spear-phishing emails targeting the finance department. The emails use a recently discovered malware family and the sender addresses mimic the CEO's name. The analyst has three hypotheses: (A) a financially motivated cybercriminal group, (B) an insider with access to internal email templates, and (C) a nation-state actor conducting reconnaissance. When building an ACH matrix, the analyst marks the evidence 'malware family used' as consistent with hypothesis A and C, but inconsistent with B. What is the most appropriate next step in the ACH process?

   • ARe-evaluate the diagnosticity of the malware evidence before drawing conclusions.
   • BRefute hypothesis B because it is contradicted by the malware evidence.
   • CRemove the malware evidence from the matrix because it does not help distinguish between hypotheses.
   • DImmediately conclude that hypothesis C is the most likely because nation-state actors often use new malware.
   Reveal Solution Discussion Select an answer first