# SEAS-8414 Chapter 10 Homework
## Blackboard Multiple-Choice Assessment: Active Deception and Threat Hunting

**Use:** Due before the next Chapter 11 class session
**Total Points:** 100
**Format:** 50 single-correct-answer multiple choice questions, 2 points each
**Audience:** Doctoral students and senior cybersecurity practitioners

This assessment is designed for Blackboard delivery. Every item is multiple choice
with exactly one correct answer. The assessment is closed book: do not use the
textbook, notes, internet search, lab files, scanners, AI tools, or outside
incident writeups while answering.

Each question includes a scenario-provenance label. That label is a citation
trail for instructors and is never required to choose the answer. Every formula,
threshold, rule, or evidence contract required to answer appears inside the stem.

Chapter boundary: answer only within Chapter 10 deception analytics, threat hunting, and forensic evidence chains only. Do not import capabilities
from other chapters unless the stem explicitly defines them.

---

### Question 1

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program updates a deception policy. The Q-learning rule is Q_new = Q_old + alpha*(reward + gamma*max_next - Q_old). Q_old=0.6, alpha=0.2, reward=3.0, gamma=0.8, max_next=1.5. Which Q_new follows?

(a) 1.08
(b) 4.20
(c) 1.38
(d) 1.32
### Question 2

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority updates an attacker-skill belief. Priors for novice/operator/advanced are 0.50/0.30/0.20. Likelihoods for the observed event are 0.20/0.25/0.60. Posterior is prior*likelihood normalized by the sum. Which result follows?

(a) 0.10/0.07/0.12; advanced
(b) 0.41/0.25/0.34; novice
(c) 0.34/0.25/0.41; advanced
(d) 0.20/0.25/0.60; advanced
### Question 3

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility builds a Merkle evidence tree for a honeypot session. The rule is: pad leaves to the next power of two, and inclusion proof length is log2(padded_leaf_count). The session has 256 packets. Which proof length follows?

(a) 9 sibling hashes
(b) 8 sibling hashes
(c) No determinate answer can be computed from the stated rule.
(d) 256 sibling hashes
### Question 4

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network scores a honeypot placement. The rule is score = min(5.0, nearby_CVEs*0.3) + centrality*2.0 + 2.0 if within five IPs of an attack-path target; then multiply by 0.5 if the IP is at a subnet edge. nearby_CVEs=9, centrality=0.2, near_attack_path=True, subnet_edge=True. Which score follows?

(a) 2.55
(b) 5.10
(c) 4.90
(d) No determinate answer can be computed from the stated rule.
### Question 5

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority labels a decoy session. For this question, commands touching PLC state or PLC upload are ICS-impact commands; Linux file/history commands are host-enumeration or anti-forensics commands. A session is advanced if it contains at least 2 ICS-impact and at least 2 Linux/anti-forensic commands. The observed session has 3 ICS-impact commands and 1 Linux/anti-forensic commands. Which label follows?

(a) advanced
(b) novice
(c) automated scanner
(d) intermediate
### Question 6

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator monitors credential canaries in deception telemetry. The rule is canary_hit_rate = canary_hits / sessions, and alert when the rate is >=0.15. canary_hits=1, sessions=50. Which result follows?

(a) 0.020; alert
(b) 51.000; alert
(c) 0.020; no alert
(d) 50.000; alert
### Question 7

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator computes a decoy reward. The rule is reward = intelligence_value*1.0 - detection_risk*2.0 - operating_cost*0.5. intelligence_value=5, detection_risk=4, operating_cost=3. Which reward follows?

(a) -3.0
(b) -4.5
(c) -2.0
(d) 11.5
### Question 8

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant checks a forensic evidence package. The rule is evidence_integrity_pass only if Merkle_root_matches, hash_chain_continuous, and custodian_log_complete are all true. Merkle_root_matches=True, hash_chain_continuous=False, custodian_log_complete=True. Which result follows?

(a) evidence_integrity_fail
(b) evidence_integrity_pass
(c) partial pass; publish anyway
(d) discard all deception telemetry
### Question 9

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network evaluates moving-target coverage. The rule is coverage = min(1.0, rotated_slots * 10 / candidate_IP_pool). rotated_slots=7, candidate_IP_pool=35. Which coverage follows?

(a) 0.20
(b) 2.00
(c) 0.50
(d) 1.00
### Question 10

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program sizes a Chameleon Q-learning table. The rule is Q_values = states * actions. The deception controller has 560 states and 6 actions. Which table size follows?

(a) 560 Q-values
(b) 6 Q-values
(c) 3360 Q-values
(d) 566 Q-values
### Question 11

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative updates a deception policy. The Q-learning rule is Q_new = Q_old + alpha*(reward + gamma*max_next - Q_old). Q_old=0.6, alpha=0.3, reward=5.0, gamma=0.8, max_next=2.5. Which Q_new follows?

(a) 2.67
(b) 2.52
(c) 1.92
(d) 7.00
### Question 12

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site updates an attacker-skill belief. Priors for novice/operator/advanced are 0.50/0.30/0.20. Likelihoods for the observed event are 0.10/0.25/0.60. Posterior is prior*likelihood normalized by the sum. Which result follows?

(a) 0.20/0.31/0.49; advanced
(b) 0.10/0.25/0.60; advanced
(c) 0.05/0.07/0.12; advanced
(d) 0.49/0.31/0.20; novice
### Question 13

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program builds a Merkle evidence tree for a honeypot session. The rule is: pad leaves to the next power of two, and inclusion proof length is log2(padded_leaf_count). The session has 256 packets. Which proof length follows?

(a) No determinate answer can be computed from the stated rule.
(b) 256 sibling hashes
(c) 9 sibling hashes
(d) 8 sibling hashes
### Question 14

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority scores a honeypot placement. The rule is score = min(5.0, nearby_CVEs*0.3) + centrality*2.0 + 2.0 if within five IPs of an attack-path target; then multiply by 0.5 if the IP is at a subnet edge. nearby_CVEs=7, centrality=0.7, near_attack_path=True, subnet_edge=False. Which score follows?

(a) 4.80
(b) No determinate answer can be computed from the stated rule.
(c) 5.50
(d) 11.00
### Question 15

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility labels a decoy session. For this question, commands touching PLC state or PLC upload are ICS-impact commands; Linux file/history commands are host-enumeration or anti-forensics commands. A session is advanced if it contains at least 2 ICS-impact and at least 2 Linux/anti-forensic commands. The observed session has 3 ICS-impact commands and 1 Linux/anti-forensic commands. Which label follows?

(a) automated scanner
(b) intermediate
(c) advanced
(d) novice
### Question 16

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network monitors credential canaries in deception telemetry. The rule is canary_hit_rate = canary_hits / sessions, and alert when the rate is >=0.15. canary_hits=5, sessions=20. Which result follows?

(a) 0.250; alert
(b) 4.000; alert
(c) 0.250; no alert
(d) 25.000; alert
### Question 17

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority computes a decoy reward. The rule is reward = intelligence_value*1.0 - detection_risk*2.0 - operating_cost*0.5. intelligence_value=5, detection_risk=2, operating_cost=2. Which reward follows?

(a) 1.0
(b) 8.0
(c) No determinate answer can be computed from the stated rule.
(d) 0.0
### Question 18

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator checks a forensic evidence package. The rule is evidence_integrity_pass only if Merkle_root_matches, hash_chain_continuous, and custodian_log_complete are all true. Merkle_root_matches=False, hash_chain_continuous=True, custodian_log_complete=True. Which result follows?

(a) partial pass; publish anyway
(b) discard all deception telemetry
(c) evidence_integrity_fail
(d) evidence_integrity_pass
### Question 19

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator evaluates moving-target coverage. The rule is coverage = min(1.0, rotated_slots * 10 / candidate_IP_pool). rotated_slots=5, candidate_IP_pool=45. Which coverage follows?

(a) 0.90
(b) 1.00
(c) 0.11
(d) 1.11
### Question 20

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant sizes a Chameleon Q-learning table. The rule is Q_values = states * actions. The deception controller has 420 states and 6 actions. Which table size follows?

(a) 2520 Q-values
(b) 426 Q-values
(c) 420 Q-values
(d) 6 Q-values
### Question 21

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network updates a deception policy. The Q-learning rule is Q_new = Q_old + alpha*(reward + gamma*max_next - Q_old). Q_old=0.6, alpha=0.1, reward=3.0, gamma=0.8, max_next=1.5. Which Q_new follows?

(a) 0.84
(b) 4.20
(c) 0.99
(d) 0.96
### Question 22

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program updates an attacker-skill belief. Priors for novice/operator/advanced are 0.50/0.30/0.20. Likelihoods for the observed event are 0.15/0.25/0.60. Posterior is prior*likelihood normalized by the sum. Which result follows?

(a) 0.08/0.07/0.12; advanced
(b) 0.44/0.28/0.28; novice
(c) 0.28/0.28/0.44; advanced
(d) 0.15/0.25/0.60; advanced
### Question 23

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative builds a Merkle evidence tree for a honeypot session. The rule is: pad leaves to the next power of two, and inclusion proof length is log2(padded_leaf_count). The session has 256 packets. Which proof length follows?

(a) 9 sibling hashes
(b) 8 sibling hashes
(c) No determinate answer can be computed from the stated rule.
(d) 256 sibling hashes
### Question 24

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site scores a honeypot placement. The rule is score = min(5.0, nearby_CVEs*0.3) + centrality*2.0 + 2.0 if within five IPs of an attack-path target; then multiply by 0.5 if the IP is at a subnet edge. nearby_CVEs=5, centrality=0.2, near_attack_path=True, subnet_edge=True. Which score follows?

(a) 1.95
(b) 3.90
(c) 3.70
(d) No determinate answer can be computed from the stated rule.
### Question 25

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program labels a decoy session. For this question, commands touching PLC state or PLC upload are ICS-impact commands; Linux file/history commands are host-enumeration or anti-forensics commands. A session is advanced if it contains at least 2 ICS-impact and at least 2 Linux/anti-forensic commands. The observed session has 3 ICS-impact commands and 1 Linux/anti-forensic commands. Which label follows?

(a) advanced
(b) novice
(c) automated scanner
(d) intermediate
### Question 26

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority monitors credential canaries in deception telemetry. The rule is canary_hit_rate = canary_hits / sessions, and alert when the rate is >=0.15. canary_hits=3, sessions=30. Which result follows?

(a) 0.100; alert
(b) 33.000; alert
(c) 0.100; no alert
(d) 10.000; alert
### Question 27

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility computes a decoy reward. The rule is reward = intelligence_value*1.0 - detection_risk*2.0 - operating_cost*0.5. intelligence_value=5, detection_risk=4, operating_cost=1. Which reward follows?

(a) -3.0
(b) -3.5
(c) 0.0
(d) 12.5
### Question 28

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network checks a forensic evidence package. The rule is evidence_integrity_pass only if Merkle_root_matches, hash_chain_continuous, and custodian_log_complete are all true. Merkle_root_matches=True, hash_chain_continuous=False, custodian_log_complete=True. Which result follows?

(a) evidence_integrity_fail
(b) evidence_integrity_pass
(c) partial pass; publish anyway
(d) discard all deception telemetry
### Question 29

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority evaluates moving-target coverage. The rule is coverage = min(1.0, rotated_slots * 10 / candidate_IP_pool). rotated_slots=9, candidate_IP_pool=55. Which coverage follows?

(a) 0.16
(b) 1.64
(c) 0.61
(d) 1.00
### Question 30

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator sizes a Chameleon Q-learning table. The rule is Q_values = states * actions. The deception controller has 280 states and 6 actions. Which table size follows?

(a) 280 Q-values
(b) 6 Q-values
(c) 1680 Q-values
(d) 286 Q-values
### Question 31

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator updates a deception policy. The Q-learning rule is Q_new = Q_old + alpha*(reward + gamma*max_next - Q_old). Q_old=0.6, alpha=0.2, reward=5.0, gamma=0.8, max_next=2.5. Which Q_new follows?

(a) 1.98
(b) 1.88
(c) 1.48
(d) 7.00
### Question 32

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant updates an attacker-skill belief. Priors for novice/operator/advanced are 0.50/0.30/0.20. Likelihoods for the observed event are 0.20/0.25/0.60. Posterior is prior*likelihood normalized by the sum. Which result follows?

(a) 0.34/0.25/0.41; advanced
(b) 0.20/0.25/0.60; advanced
(c) 0.10/0.07/0.12; advanced
(d) 0.41/0.25/0.34; novice
### Question 33

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network builds a Merkle evidence tree for a honeypot session. The rule is: pad leaves to the next power of two, and inclusion proof length is log2(padded_leaf_count). The session has 256 packets. Which proof length follows?

(a) No determinate answer can be computed from the stated rule.
(b) 256 sibling hashes
(c) 9 sibling hashes
(d) 8 sibling hashes
### Question 34

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program scores a honeypot placement. The rule is score = min(5.0, nearby_CVEs*0.3) + centrality*2.0 + 2.0 if within five IPs of an attack-path target; then multiply by 0.5 if the IP is at a subnet edge. nearby_CVEs=9, centrality=0.7, near_attack_path=True, subnet_edge=False. Which score follows?

(a) 5.40
(b) No determinate answer can be computed from the stated rule.
(c) 6.10
(d) 12.20
### Question 35

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative labels a decoy session. For this question, commands touching PLC state or PLC upload are ICS-impact commands; Linux file/history commands are host-enumeration or anti-forensics commands. A session is advanced if it contains at least 2 ICS-impact and at least 2 Linux/anti-forensic commands. The observed session has 3 ICS-impact commands and 1 Linux/anti-forensic commands. Which label follows?

(a) automated scanner
(b) intermediate
(c) advanced
(d) novice
### Question 36

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site monitors credential canaries in deception telemetry. The rule is canary_hit_rate = canary_hits / sessions, and alert when the rate is >=0.15. canary_hits=1, sessions=40. Which result follows?

(a) 0.025; no alert
(b) 40.000; alert
(c) 0.025; alert
(d) 41.000; alert
### Question 37

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program computes a decoy reward. The rule is reward = intelligence_value*1.0 - detection_risk*2.0 - operating_cost*0.5. intelligence_value=5, detection_risk=2, operating_cost=3. Which reward follows?

(a) 0.0
(b) 7.5
(c) 1.0
(d) -0.5
### Question 38

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority checks a forensic evidence package. The rule is evidence_integrity_pass only if Merkle_root_matches, hash_chain_continuous, and custodian_log_complete are all true. Merkle_root_matches=True, hash_chain_continuous=True, custodian_log_complete=True. Which result follows?

(a) partial pass; publish anyway
(b) discard all deception telemetry
(c) evidence_integrity_pass
(d) evidence_integrity_fail
### Question 39

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility evaluates moving-target coverage. The rule is coverage = min(1.0, rotated_slots * 10 / candidate_IP_pool). rotated_slots=7, candidate_IP_pool=65. Which coverage follows?

(a) 0.93
(b) 1.00
(c) 0.11
(d) 1.08
### Question 40

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network sizes a Chameleon Q-learning table. The rule is Q_values = states * actions. The deception controller has 560 states and 6 actions. Which table size follows?

(a) 3360 Q-values
(b) 566 Q-values
(c) 560 Q-values
(d) 6 Q-values
### Question 41

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority updates a deception policy. The Q-learning rule is Q_new = Q_old + alpha*(reward + gamma*max_next - Q_old). Q_old=0.6, alpha=0.3, reward=3.0, gamma=0.8, max_next=1.5. Which Q_new follows?

(a) 1.32
(b) 4.20
(c) 1.77
(d) 1.68
### Question 42

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator updates an attacker-skill belief. Priors for novice/operator/advanced are 0.50/0.30/0.20. Likelihoods for the observed event are 0.10/0.25/0.60. Posterior is prior*likelihood normalized by the sum. Which result follows?

(a) 0.05/0.07/0.12; advanced
(b) 0.49/0.31/0.20; novice
(c) 0.20/0.31/0.49; advanced
(d) 0.10/0.25/0.60; advanced
### Question 43

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator builds a Merkle evidence tree for a honeypot session. The rule is: pad leaves to the next power of two, and inclusion proof length is log2(padded_leaf_count). The session has 256 packets. Which proof length follows?

(a) 9 sibling hashes
(b) 8 sibling hashes
(c) No determinate answer can be computed from the stated rule.
(d) 256 sibling hashes
### Question 44

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant scores a honeypot placement. The rule is score = min(5.0, nearby_CVEs*0.3) + centrality*2.0 + 2.0 if within five IPs of an attack-path target; then multiply by 0.5 if the IP is at a subnet edge. nearby_CVEs=7, centrality=0.2, near_attack_path=True, subnet_edge=True. Which score follows?

(a) 2.25
(b) 4.50
(c) 4.30
(d) No determinate answer can be computed from the stated rule.
### Question 45

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network labels a decoy session. For this question, commands touching PLC state or PLC upload are ICS-impact commands; Linux file/history commands are host-enumeration or anti-forensics commands. A session is advanced if it contains at least 2 ICS-impact and at least 2 Linux/anti-forensic commands. The observed session has 3 ICS-impact commands and 1 Linux/anti-forensic commands. Which label follows?

(a) advanced
(b) novice
(c) automated scanner
(d) intermediate
### Question 46

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program monitors credential canaries in deception telemetry. The rule is canary_hit_rate = canary_hits / sessions, and alert when the rate is >=0.15. canary_hits=5, sessions=50. Which result follows?

(a) 0.100; alert
(b) 55.000; alert
(c) 0.100; no alert
(d) 10.000; alert
### Question 47

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative computes a decoy reward. The rule is reward = intelligence_value*1.0 - detection_risk*2.0 - operating_cost*0.5. intelligence_value=5, detection_risk=4, operating_cost=2. Which reward follows?

(a) -3.0
(b) -4.0
(c) -1.0
(d) 12.0
### Question 48

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site checks a forensic evidence package. The rule is evidence_integrity_pass only if Merkle_root_matches, hash_chain_continuous, and custodian_log_complete are all true. Merkle_root_matches=False, hash_chain_continuous=False, custodian_log_complete=True. Which result follows?

(a) evidence_integrity_fail
(b) evidence_integrity_pass
(c) partial pass; publish anyway
(d) discard all deception telemetry
### Question 49

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program evaluates moving-target coverage. The rule is coverage = min(1.0, rotated_slots * 10 / candidate_IP_pool). rotated_slots=5, candidate_IP_pool=35. Which coverage follows?

(a) 0.14
(b) 1.43
(c) 0.70
(d) 1.00
### Question 50

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority sizes a Chameleon Q-learning table. The rule is Q_values = states * actions. The deception controller has 420 states and 6 actions. Which table size follows?

(a) 420 Q-values
(b) 6 Q-values
(c) 2520 Q-values
(d) 426 Q-values
