What is the purpose of sensitivity analysis in ACH?

To identify which evidence is most likely to be false

To determine how changes in evidence interpretation might affect the conclusions

To calculate the exact probability of each hypothesis

To remove evidence that is not consistent with the leading hypothesis

An analyst is constructing an ACH matrix for a malware outbreak. The hypotheses are: (H1) targeted attack by a known APT, (H2) opportunistic malware campaign, and (H3) insider action. The evidence includes: (E1) malware uses a custom packer, (E2) the malware was delivered via a phishing email with a generic template, and (E3) the malware only executed on specific high-value hosts. How should the analyst mark E3 in the matrix?

Inconsistent with all three hypotheses.

Consistent with all three hypotheses.

Consistent with H1 and H2, inconsistent with H3.

Consistent with H1, inconsistent with H2 and H3.

A junior analyst is conducting an ACH analysis and has generated only two hypotheses: 'malware infection' and 'user error'. The analyst then rates all evidence as consistent with 'malware infection' and inconsistent with 'user error'. What is the most likely ACH pitfall in this scenario?

Presenting conclusions without a rationale

Incomplete hypothesis set and confirmation bias in evidence rating

Failure to perform sensitivity analysis

Overly complex matrix with too many evidence items

What is the purpose of constructing an ACH matrix?

To rank hypotheses by the number of pieces of evidence that support them

To store evidence in a structured database for future analysis

To automate the analysis of threat intelligence data

To visually compare the consistency of each piece of evidence with each hypothesis

A threat intelligence analyst is known for being strongly opinionated about the source of a recent attack. To reduce the impact of this bias, the team decides to use ACH. Which aspect of ACH is most effective in countering this analyst's bias?

Allowing the analyst to rate evidence based on their experience

Presenting the analyst's conclusion as the final answer

Requiring the analyst to consider multiple hypotheses and evaluate evidence against each

Focusing only on evidence that supports the analyst's preferred hypothesis

EC-CouncilThreat Intelligence Essentials

Domain 6Objective 2

Analysis of Competing Hypotheses TIE Practice Questions (Page 9)

Part of the Threat Intelligence Analysis domain, which makes up ~14% of our current practice bank.

45questions here

9free pages

10concepts

Questions 41–45

41foundation · easy
What is the purpose of sensitivity analysis in ACH?
Select an answer first
42application · medium
An analyst is constructing an ACH matrix for a malware outbreak. The hypotheses are: (H1) targeted attack by a known APT, (H2) opportunistic malware campaign, and (H3) insider action. The evidence includes: (E1) malware uses a custom packer, (E2) the malware was delivered via a phishing email with a generic template, and (E3) the malware only executed on specific high-value hosts. How should the analyst mark E3 in the matrix?
Select an answer first
43expert · hard
A junior analyst is conducting an ACH analysis and has generated only two hypotheses: 'malware infection' and 'user error'. The analyst then rates all evidence as consistent with 'malware infection' and inconsistent with 'user error'. What is the most likely ACH pitfall in this scenario?
Select an answer first
44foundation · easy
What is the purpose of constructing an ACH matrix?
Select an answer first
45application · medium
A threat intelligence analyst is known for being strongly opinionated about the source of a recent attack. To reduce the impact of this bias, the team decides to use ACH. Which aspect of ACH is most effective in countering this analyst's bias?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.