Certified Threat Intelligence Analyst (CTIA) — Question 17

Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a stage where he is required to apply his analysis skills effectively to reject as many hypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top, and the listed evidence for the hypotheses are placed at the bottom.
What stage of ACH is Bob currently in?

Answer options

• A. Diagnostics
• B. Evidence
• C. Inconsistency
• D. Refinement

Correct answer: A

Explanation

The correct answer is A, Diagnostics, as this stage involves evaluating and rejecting less likely hypotheses based on available evidence. Options B, Evidence, refers to the data collected but does not represent a stage of the ACH process, while C, Inconsistency, focuses on identifying contradictions in hypotheses, and D, Refinement, involves improving the hypotheses rather than selecting among them.