Test an explanation before using it to close a case

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Public activity · 30d

—Participating browsers

—Page views

—Reading sessions

—Exercise opens

Counts reflect browsers that allowed analytics. A reading session requires 30 seconds on a visible page. Browsers are not people.

Day 14 — Test an explanation before using it to close a case

Mechanism. A discriminator is a result that changes the relative plausibility or decision relevance of an explanation. Evidence merely compatible with a hypothesis is weaker than evidence that distinguishes it from a competing account. A falsifier is a result that would weaken or contradict a specified claim under stated coverage assumptions. Write the claim narrowly enough to test. “The browser can be normal” is a possibility; “an approved scheduled run produced q-144 within scope” requires validated job provenance, request semantics and approval scope.

Assumptions and evidence. At 09:14, C04/C06/C07 motivate alternative explanations but supply none of the missing job-run receipts or S42 authorization addenda. The supplied calendar's omission of S42 does not prove that no addendum exists anywhere. Conversely, an addendum mentioning S42 would address authorization scope, not automatically establish correct execution, current state or the identity behind s-77. Keep permission, mechanism and outcome as separate questions. Hypotheses can overlap: approved automation could produce an incorrect state, and a stale display could coexist with an actual edit.

Worked contrast. Consider the benign hypothesis “an approved scheduled run accounts for q-144.” Finding an approved run at roughly 09:01 is compatible, but insufficient when that record has no request key. A custodian-validated run manifest that includes q-144 under the relevant namespace, plus a versioned S42 approval, would support the narrower hypothesis. A manifest that excludes q-144 weakens it only if the custodian establishes that the manifest covers the relevant run, route and interval. Absence from a partial export is not that falsifier. None of these hypothetical results has been collected in the case.

For the concerning hypothesis “q-144 was outside approval,” a valid S42 authorization covering that specific operation would weaken the authorization claim. It would not prove the resulting enrollment state was correct. For a display-only explanation, a verified wrong authoritative state would refute the word only; a stale browser view cannot by itself account for the backend discrepancy. Ask for the smallest authorized comparison rather than a tenant-wide data dump.

Decision and closure gate. Maintain the case while discriminators are pending. A defensible benign disposition needs the organization's actual rule, sufficient scope, a checked result, an accepting owner and the unresolved questions carried forward. The response may instead be “known service defect, security cause unconfirmed.” Distinguish an alert's detection logic firing incorrectly from an accurate signal explained by benign activity, and from a case whose evidence is insufficient. The label “false positive” should not erase a genuine edit or a service fault. NIST SP 800-61 Rev. 3 supplies response context; this hypothesis table is original supervised practice.

Practice. Complete EX014 with two benign hypotheses and one concerning hypothesis. For each, give a requested source, a supporting result, a weakening result and its coverage condition. Compare the worked answer. Limit: discriminators refine claims; without an actually obtained result, they remain a collection plan. No later C09–C12 fact may be borrowed to finish this exercise.

Continue studying — course Day 14: Previous: Day 13 · Week 3 index · Course index · Next: Day 15.

Exercise for this lesson

EX014 — False-positive gate. Objective: distinguish a compatible story from a tested disposition. Input: C04/C06/C07 in the C02–C08 context at 09:14. Write two benign hypotheses and one concerning hypothesis. For each, name the minimum requested source, a supporting result, a result that would weaken it, and the coverage/identifier assumption that makes that result meaningful. State why closure is still pending; a scoped authorization alone cannot prove correct execution or current state. Rubric: 0 = invented collected evidence or definitive benign/malicious closure; 1 = three plausible hypotheses but a nondiscriminating test or reversed support/falsification; 2 = three conditional tests with correctly directed results, source limitations and an explicit pending disposition. No C09 or later card is available. Worked answer.

Practice the exercises

Open a prompt, write your response, then compare it with the worked answer. Five-choice practice appears where a reviewed question is available.

EX014

Open the prompt →Compare with the worked answer →

Opens in 30 days: — · browsers: —

Checking for a reviewed five-choice question…

Worked answers

EX014 — Model gates. Benign explanation 1: C04 browser is scheduled runner activity; discriminate with a preserved, approved job-run record and known expected process behavior. Benign explanation 2: C06's visible calendar is incomplete; discriminate with a signed S42 addendum and its scope. Concerning explanation: shared account used outside approval to edit S42; discriminate with identity access trail, validated session/request join and change scope. None of these source records is in hand at 09:14, so the labels remain hypotheses. A “false positive” closure would need the organization’s actual closure rule and supporting results.

Additional worked reasoning (EX014 — Closure must have evidence.): Benign candidates are ordinary runner activity and an omitted S42 approval addendum; a concerning candidate is use of the shared account outside approval. A validated job-to-request link and applicable signed scope would support, not falsify, the benign approved-run explanation. A complete, correctly scoped manifest excluding q-144 would weaken that explanation; an incomplete manifest would not. A valid S42 authorization would weaken the outside-approval claim without proving correct execution or state. Current C04/C06/C07 supply none of those discriminator results. The disposition remains pending, not “false positive” or “attacker confirmed.”

Week 3 Day 14 — worked discriminator table. All results below are requested/hypothetical, not collected evidence at 09:14.

Lesson table; scroll horizontally to read all columns →

Hypothesis	Minimum source and support	Result that would weaken it	Required boundary
The runner browser is ordinary scheduled activity	Endpoint/job custodian's preserved process and run records match an expected approved execution	A validated complete run record contradicts the expected process/run relationship	Coverage of the relevant host, interval and process identity; browser presence alone is insufficient
An omitted approval addendum authorizes the S42 edit	Versioned authorization explicitly covers the operation, target and time	The authoritative complete approval ledger and responsible owner establish no applicable S42 authorization	Completeness and approving authority must be established; omission from C06 alone cannot do this
The shared account performed q-144 outside approval	Validated application provenance plus a complete authorization comparison excludes the specific edit	A valid authorization covers that exact edit; this weakens the scope claim even if execution was faulty	Validate request namespaces and operation scope; account equality does not attribute a human

The first row concerns the browser's explanation, not proof that it caused q-144. The second and third concern authorization; neither settles current S42 correctness. A job/request join could support an approved-run explanation, while a complete manifest excluding the request could weaken it. Reversing those directions is a substantive reasoning error. Closure awaits actual discriminator results and the organization's accepting owner/rule; do not manufacture either from a table.