Analysis of Competing Hypotheses TIE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is the correct final step in the eight-step ACH process?

   • AIdentify information gaps that could affect the analysis
   • BPresent the conclusions and the rationale for each hypothesis
   • CBuild a matrix of evidence against hypotheses
   • DConduct sensitivity analysis on the conclusions
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is using ACH to determine whether a recent malware infection was caused by a phishing email, a drive-by download, or a removable device. The matrix shows the phishing hypothesis as the most consistent. However, the analyst realizes that there is no evidence about whether the user visited any malicious websites. What should the analyst do?

   • AIdentify the missing evidence as an information gap and note that it could change the ranking of hypotheses.
   • BRefute the drive-by download hypothesis because there is no evidence to support it.
   • CConclude that the phishing hypothesis is correct because it is the most consistent.
   • DAssume the user did not visit any malicious websites because the phishing hypothesis is leading.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A threat intelligence team is analyzing a series of ransomware attacks against manufacturing firms. The attacks use a new variant that shares code with a known ransomware family. The team is brainstorming hypotheses. One analyst proposes only two hypotheses: (1) a known cybercriminal group and (2) a copycat using leaked code. What is the primary risk of this approach?

   • AThe team may miss a third plausible hypothesis, such as a nation-state actor using the same code.
   • BThe hypotheses are too similar to each other, making the matrix uninformative.
   • CThe team will waste time evaluating unlikely hypotheses.
   • DThe evidence will be too ambiguous to evaluate against only two hypotheses.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the context of threat intelligence analysis, which statement best describes the role of Analysis of Competing Hypotheses (ACH)?

   • AIt is a framework for classifying malware families based on behavioral indicators
   • BIt is a structured method to evaluate multiple possible explanations for observed threat activity
   • CIt is a tool for automatically correlating indicators of compromise (IOCs) in real time
   • DIt is a protocol for sharing threat intelligence with external partners
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   In an ACH matrix, you have the following evidence: 'The attacker used a zero-day exploit.' This evidence is highly diagnostic because it is consistent with a state-sponsored hypothesis but inconsistent with a cybercriminal hypothesis. However, you later learn that the zero-day was actually a publicly known vulnerability that was patched months ago. How should this new information affect your matrix?

   • AKeep the evidence as highly diagnostic because the attacker believed it was a zero-day
   • BChange the hypothesis set to exclude the state-sponsored hypothesis
   • CRemove the evidence entirely because it is now irrelevant
   • DRe-rate the evidence as less diagnostic, possibly neutral, because it no longer strongly supports the state-sponsored hypothesis
   Reveal Solution Discussion Select an answer first