Analysis of Competing Hypotheses TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common pitfall when applying ACH?

   • APresenting the results to stakeholders
   • BFailing to consider all plausible hypotheses
   • CIncluding too many hypotheses in the analysis
   • DUsing qualitative evidence in the matrix
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Your ACH matrix shows that Hypothesis A is ranked highest, but only because you rated the evidence 'The IP address is registered to a known hosting provider' as inconsistent with Hypothesis B. You are not fully confident in that rating. What should you do to test the robustness of your conclusion?

   • AKeep the original rating because you must be consistent with your initial judgment
   • BRe-run the matrix with that evidence rated as neutral or consistent with Hypothesis B and observe if the ranking changes
   • CAdd more evidence that supports Hypothesis A to confirm the ranking
   • DRemove Hypothesis B from the matrix because the evidence is uncertain
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Why does ACH emphasize refuting hypotheses rather than confirming them?

   • ABecause it is easier to prove a hypothesis false than to prove it true
   • BBecause confirming a hypothesis is impossible in threat intelligence
   • CBecause refutation is faster than confirmation
   • DBecause seeking confirming evidence can lead to confirmation bias
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of an information gap in an ACH analysis?

   • AThe source of a malware sample is unknown
   • BThe analysis has been reviewed by a second analyst
   • CThe conclusion has been presented to management
   • DThe malware sample has been fully reverse-engineered
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When generating hypotheses for an ACH analysis, what is the most important characteristic of the hypothesis set?

   • AIt includes only the most likely explanations to avoid confusion
   • BIt is based on the analyst's initial judgment of the most probable cause
   • CIt is limited to hypotheses that are supported by at least one piece of evidence
   • DIt is comprehensive and includes all plausible explanations
   Reveal Solution Discussion Select an answer first