Analysis of Competing Hypotheses TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An intelligence team is using ACH to analyze a series of ransomware attacks. The team has identified three hypotheses: a known ransomware group, a new group using leaked code, and an insider. During the analysis, the team discovers that the ransomware code contains a unique string that has only been seen in one previous attack attributed to a different group. What should the team do?

   • AAdd a new hypothesis that the previous group is responsible, even if it seems unlikely.
   • BKeep the existing hypotheses and treat the unique string as evidence for the known ransomware group.
   • CRefute the insider hypothesis because the code is too sophisticated for an insider.
   • DRemove the unique string from the evidence because it is confusing.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An analyst is applying ACH to determine whether a series of login anomalies are due to a credential-stuffing bot, a targeted attacker, or a misconfigured application. The analyst has collected evidence from logs and threat feeds. However, the analyst only included evidence that was easy to obtain and ignored logs that were difficult to parse. What is the primary pitfall this analyst is falling into?

   • ABiased evidence selection, which can skew the matrix toward a particular hypothesis.
   • BUsing too many hypotheses, making the analysis unmanageable.
   • CFailing to refute any hypotheses, leaving all options open.
   • DOveremphasizing the diagnosticity of the easy-to-obtain evidence.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a limitation of ACH that analysts should be aware of?

   • AIt guarantees the correct hypothesis will be identified
   • BIt can be time-consuming and requires careful documentation
   • CIt is only applicable to cyber threat intelligence, not other domains
   • DIt eliminates the need for expert judgment
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After building an ACH matrix, you notice that the top two hypotheses are nearly tied. The only evidence that separates them is a single report from an unverified source. What is the most appropriate next step?

   • APresent the matrix as is, noting that the top hypothesis is only slightly more likely
   • BIdentify this as a key information gap and seek additional corroborating or refuting evidence
   • CRemove the unverified report from the matrix to avoid bias
   • DCombine the top two hypotheses into one to simplify the analysis
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the eight-step ACH process, what is the first step an analyst should perform?

   • ADefine the problem or question to be analyzed
   • BIdentify the evidence relevant to the problem
   • CRefine the hypotheses to eliminate those that are unlikely
   • DIdentify a comprehensive set of hypotheses
   Reveal Solution Discussion Select an answer first