Analysis of Competing Hypotheses TIE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An analyst is using ACH to evaluate three hypotheses about a data breach. The evidence includes a log entry that shows an administrator account was used to access the data at 2:00 AM. The analyst initially marks this evidence as inconsistent with the 'insider threat' hypothesis because the administrator claims they were not working at that time. However, the log entry could be the result of a stolen credential. What is the most appropriate action?

   • ARefute the insider hypothesis because the administrator's claim contradicts the log evidence.
   • BRemove the log entry from the matrix because it is unreliable.
   • CChange the insider hypothesis to exclude the administrator's actions.
   • DMark the evidence as ambiguous and consider the possibility of a stolen credential in the evaluation.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   Your ACH analysis has produced a matrix where Hypothesis A and Hypothesis B are tied. The only evidence that differentiates them is a single piece of intelligence from a source with moderate reliability. You have limited time and resources. What is the most efficient way to break the tie?

   • AChoose Hypothesis A because it is more dangerous
   • BIdentify what specific evidence would change the ranking and prioritize collection of that evidence
   • CPresent the tie to leadership and let them decide
   • DRemove the unreliable evidence and declare the hypotheses indistinguishable
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   Your team has observed a series of spear-phishing emails targeting executives, each containing a link to a credential-harvesting page. During the ACH brainstorming step, an analyst proposes only two hypotheses: 'state-sponsored espionage' and 'financially motivated crime'. What is the most important reason to expand this set before building the matrix?

   • ATo satisfy the requirement that all hypotheses be mutually exclusive and collectively exhaustive
   • BTo reduce the number of evidence items needed for the matrix
   • CTo ensure the evidence is evaluated against a comprehensive set of plausible explanations
   • DTo guarantee that the most likely hypothesis is the one with the most supporting evidence
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of using Analysis of Competing Hypotheses (ACH) in threat intelligence analysis?

   • ATo automate the collection of threat data from multiple sources
   • BTo prioritize threat intelligence sources based on their historical accuracy
   • CTo reduce cognitive biases by systematically evaluating multiple explanations against evidence
   • DTo encrypt threat intelligence reports for secure sharing
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is conducting an ACH analysis on a phishing campaign that uses a legitimate cloud storage service to host malware. The analyst has identified four hypotheses and is now evaluating evidence. After completing the matrix, the analyst finds that one hypothesis is inconsistent with three pieces of evidence. According to the ACH methodology, what should the analyst do next?

   • AKeep the hypothesis and adjust the evidence interpretations to make it consistent.
   • BRefute that hypothesis and remove it from further consideration.
   • CPresent the hypothesis as still viable because ACH does not eliminate hypotheses.
   • DCombine the hypothesis with another similar hypothesis to increase its consistency.
   Reveal Solution Discussion Select an answer first