In ACH, what is the principle of refutation?

Combining multiple hypotheses into a single explanation

Assigning probabilities to each hypothesis based on evidence

Eliminating hypotheses that are contradicted by evidence

Selecting the hypothesis with the most supporting evidence

You are constructing an ACH matrix for three hypotheses (H1, H2, H3) and four evidence items (E1–E4). After rating each evidence item against each hypothesis, you notice that E1 is inconsistent with H1, consistent with H2, and neutral for H3. What does this pattern indicate?

E1 is not useful because it is not consistent with all hypotheses

E1 should be removed because it is inconsistent with H1

E1 proves that H2 is the correct hypothesis

E1 helps refute H1 and supports H2, but does not discriminate between H2 and H3

What is the purpose of identifying information gaps in ACH?

To automate the collection of missing data

To reduce the number of hypotheses in the analysis

To determine which missing information could change the ranking of hypotheses

To prove that the leading hypothesis is correct

You are presenting the results of an ACH analysis to your organization's leadership. The matrix shows that Hypothesis A is the most likely, but Hypothesis B is only slightly less likely. Which presentation approach best follows ACH principles?

Present the matrix without any explanation, letting the data speak for itself

Present Hypothesis A as a definitive conclusion because it is the most likely

Present both hypotheses with their relative likelihoods and the key evidence that supports or refutes each

Present only Hypothesis A to avoid confusing leadership with alternatives

In an ACH analysis, you have a hypothesis that is consistent with all evidence, but the evidence is not very diagnostic. Another hypothesis is inconsistent with one piece of evidence, but that evidence is highly reliable. Which hypothesis should be considered more likely?

The hypothesis with the inconsistency, because the reliable evidence refutes it, but the other hypothesis lacks strong support

Neither hypothesis can be evaluated without more evidence

Both hypotheses are equally likely because they have the same number of consistent evidence items

The hypothesis that is consistent with all evidence, because consistency is the goal

EC-CouncilThreat Intelligence Essentials

Domain 6Objective 2

Analysis of Competing Hypotheses TIE Practice Questions (Page 3)

Part of the Threat Intelligence Analysis domain, which makes up ~14% of our current practice bank.

45questions here

9free pages

10concepts

Questions 11–15

11foundation · easy
In ACH, what is the principle of refutation?
Select an answer first
12application · medium
You are constructing an ACH matrix for three hypotheses (H1, H2, H3) and four evidence items (E1–E4). After rating each evidence item against each hypothesis, you notice that E1 is inconsistent with H1, consistent with H2, and neutral for H3. What does this pattern indicate?
Select an answer first
13foundation · easy
What is the purpose of identifying information gaps in ACH?
Select an answer first
14application · medium
You are presenting the results of an ACH analysis to your organization's leadership. The matrix shows that Hypothesis A is the most likely, but Hypothesis B is only slightly less likely. Which presentation approach best follows ACH principles?
Select an answer first
15application · medium
In an ACH analysis, you have a hypothesis that is consistent with all evidence, but the evidence is not very diagnostic. Another hypothesis is inconsistent with one piece of evidence, but that evidence is highly reliable. Which hypothesis should be considered more likely?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.