Back to Subject

Unit 5 - Practice Quiz

INT396 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 In association rule mining, what does the 'Support' metric measure?

Support Easy
A. The ratio of independent occurrences of two itemsets.
B. The frequency or proportion of transactions that contain a specific itemset.
C. The probability that a rule is incorrect.
D. The error rate of the generated association rules.

2 How is the Confidence of an association rule mathematically defined?

Confidence Easy
A.
B.
C.
D.

3 What does a high confidence score for the rule {Bread} {Butter} indicate?

Confidence Easy
A. Bread and Butter are the most popular items in the store.
B. Customers who buy Bread are highly likely to also buy Butter.
C. Customers who buy Butter are highly likely to buy Bread.
D. Bread and Butter are always bought independently.

4 What does a Lift value greater than 1 indicate for an association rule ?

Lift Easy
A. X and Y are completely independent of each other.
B. The rule is invalid and should be discarded.
C. A positive correlation, meaning X and Y appear together more often than expected by chance.
D. A negative correlation, meaning X and Y appear together less often than expected.

5 Which metric evaluates the ratio of the observed support of to the expected support if X and Y were independent?

Lift Easy
A. Support
B. Confidence
C. Lift
D. Conviction

6 What is the primary purpose of the 'Conviction' metric in association rule mining?

Conviction Easy
A. To determine the speed of the Apriori algorithm.
B. To measure the ratio of the expected frequency that X occurs without Y (if independent) to the observed frequency of X occurring without Y.
C. To compress the dataset into a tree structure.
D. To measure the absolute frequency of an itemset in the database.

7 What is the core idea behind the Apriori principle?

Apriori Algorithm Easy
A. Infrequent itemsets can have frequent supersets.
B. If an itemset is frequent, then all of its subsets must also be frequent.
C. Association rules can only contain two items.
D. If an itemset is frequent, then all of its supersets must also be frequent.

8 What happens during the 'candidate generation' step of the Apriori algorithm?

Apriori Algorithm Easy
A. Anomalies in the transaction records are removed.
B. The dataset is clustered into groups based on similarity.
C. Larger itemsets (candidates) are created by joining smaller frequent itemsets from the previous pass.
D. A tree data structure is built to avoid scanning the database.

9 Which property allows the Apriori algorithm to prune the search space efficiently?

Apriori Algorithm Easy
A. Triangle inequality
B. Curse of dimensionality
C. Anti-monotone property of support
D. Monotonicity of confidence

10 What is a major advantage of the FP-Growth algorithm over the Apriori algorithm?

FP-Growth algorithm Easy
A. It generates association rules without calculating support.
B. It requires multiple scans of the database for every itemset size.
C. It does not require candidate generation.
D. It is only applicable to continuous numerical data.

11 Which data structure is uniquely utilized by the FP-Growth algorithm to compress database transactions?

FP-Growth algorithm Easy
A. B-Tree
B. FP-Tree (Frequent Pattern Tree)
C. KD-Tree
D. Binary Search Tree

12 What is the primary business goal of Market Basket Analysis?

Market Basket Analysis Easy
A. To classify customers based on their age and income.
B. To predict the exact total price of a customer's basket.
C. To identify combinations of products that are frequently bought together.
D. To detect credit card fraud at checkout.

13 Which of the following scenarios is a classic application of Market Basket Analysis?

Market Basket Analysis Easy
A. Predicting future housing prices based on square footage.
B. Placing diapers and beer near each other in a supermarket based on past purchasing data.
C. Classifying images of cats and dogs.
D. Filtering spam emails out of an inbox.

14 What is the main difference between anomaly detection and novelty detection?

Anomaly Detection: Anomaly vs. novelty detection Easy
A. Novelty detection finds frequent items, while anomaly detection finds association rules.
B. There is no difference; they are exactly the same concept in all contexts.
C. Novelty detection is supervised learning, while anomaly detection is reinforcement learning.
D. Novelty detection assumes the training data has no outliers, while anomaly detection assumes training data may contain outliers.

15 In the context of machine learning, how is an 'anomaly' defined?

Anomaly Detection: Anomaly vs. novelty detection Easy
A. The most frequently occurring data point in a dataset.
B. A data point that differs significantly from the majority of other observations.
C. A missing value in a dataset.
D. The average or mean value of a particular feature.

16 How does the Isolation Forest algorithm identify anomalies?

Isolation Forest Easy
A. Anomalies require fewer random splits (shorter path lengths) to be isolated in a tree.
B. It isolates data points based on their frequency in an FP-Tree.
C. It calculates the Euclidean distance to the nearest neighbor.
D. Anomalies require more random splits (longer path lengths) to be isolated.

17 The Isolation Forest algorithm is fundamentally based on which type of machine learning structure?

Isolation Forest Easy
A. Artificial Neural Networks
B. K-Means Clustering
C. Support Vector Machines
D. Decision Trees

18 What core concept does the Local Outlier Factor (LOF) algorithm use to find anomalies?

Local Outlier Factor (LOF) Easy
A. It counts the absolute number of points in a given radius globally.
B. It compares the local density of a data point to the local densities of its neighbors.
C. It calculates the length of paths in a forest of random trees.
D. It calculates the support and confidence of items in transactions.

19 If a data point has an LOF score significantly greater than 1, what does this typically imply?

Local Outlier Factor (LOF) Easy
A. The point is the exact center of a cluster.
B. The point is perfectly normal (an inlier).
C. The point is part of a frequent itemset.
D. The point is likely an outlier or anomaly.

20 Why is unsupervised anomaly detection particularly useful in cybersecurity (e.g., intrusion detection)?

Applications in Cybersecurity and Fraud Detection Easy
A. It automatically repairs all software vulnerabilities.
B. It can detect new, previously unknown attacks (zero-day threats) without needing labeled examples of those attacks.
C. It uses labeled data to perfectly classify known viruses.
D. It encrypts all incoming and outgoing network traffic.

21 In a dataset of 200 transactions, itemset appears 60 times, itemset appears 80 times, and both and appear together in 30 transactions. What is the support of the rule ?

Support Medium
A. 0.50
B. 0.15
C. 0.30
D. 0.375

22 Suppose the support of itemset is 0.20, the support of itemset is 0.40, and the support of is 0.15. What is the confidence of the association rule ?

Confidence Medium
A. 0.60
B. 0.15
C. 0.375
D. 0.75

23 For the association rule , the confidence is 0.8 and the support of in the entire dataset is 0.4. What is the Lift of this rule, and what does it indicate?

Lift Medium
A. Lift = 1.2; and are independent.
B. Lift = 2.0; and are negatively correlated.
C. Lift = 0.5; and are negatively correlated.
D. Lift = 2.0; and are positively correlated.

24 A lift value of 0.6 for the rule implies what about the relationship between items and ?

Lift Medium
A. They are negatively correlated, meaning they act as substitutes.
B. always appears whenever appears in a transaction.
C. They are completely independent of each other.
D. The presence of increases the likelihood of occurring.

25 The rule has a confidence of 0.75. If the overall probability of occurring in the dataset is 0.5, what is the conviction of this rule?

Conviction Medium
A. 2.0
B. 1.5
C. 0.5
D. 1.0

26 The Apriori algorithm relies heavily on the anti-monotone property of support. Which of the following best describes this property?

Apriori Algorithm Medium
A. If an itemset is frequent, all its supersets must also be frequent.
B. If an itemset is infrequent, all its supersets must be infrequent.
C. Confidence is always strictly greater than or equal to support.
D. The support of an itemset is always equal to the sum of the supports of its subsets.

27 During the candidate generation step of the Apriori algorithm, if a candidate 3-itemset is , what condition must be met for it to survive the pruning step?

Apriori Algorithm Medium
A. It must have a confidence greater than its support.
B. At least one of its 2-item subsets must be in the set of frequent 2-itemsets ().
C. Only the subset needs to be present in .
D. All of its 2-item subsets () must be present in the set of frequent 2-itemsets ().

28 How does the FP-Growth algorithm primarily improve upon the efficiency of the Apriori algorithm?

FP-Growth algorithm Medium
A. It processes the database using an SQL JOIN instead of traditional looping.
B. It uses confidence thresholds instead of support to drastically reduce the search space.
C. It builds a compact tree structure and extracts frequent itemsets without explicit candidate generation.
D. It generates candidates using a join step without a computationally expensive pruning phase.

29 When constructing an FP-Tree, the items within each scanned transaction are sorted before insertion. What is the standard sorting order used?

FP-Growth algorithm Medium
A. The order in which they physically appear in the original database.
B. Increasing order of their global support frequencies.
C. Decreasing order of their global support frequencies.
D. Alphabetical or lexicographical order.

30 In Market Basket Analysis, if the rule has high support but a lift close to 1.0, what does this indicate to a retailer?

Market Basket Analysis Medium
A. Customers almost never buy both items together in a single trip.
B. Milk and Bread are highly dependent on each other; a discount on one drives the other.
C. The co-occurrence of Milk and Bread is largely due to their high individual frequencies, not a strong specific association.
D. Buying Milk actively prevents the customer from buying Bread.

31 When designing promotional strategies using Market Basket Analysis, a high confidence for the rule suggests that:

Market Basket Analysis Medium
A. Batteries are the most frequently purchased item in the store.
B. Discounting Batteries will definitively cause a massive spike in Flashlight sales.
C. Flashlights and Batteries should be placed far apart to encourage impulse buying.
D. Most transactions that contain a Flashlight also contain Batteries.

32 Which of the following best distinguishes novelty detection from standard anomaly detection?

Anomaly Detection: Anomaly vs. novelty detection Medium
A. Novelty detection uses supervised decision trees, whereas anomaly detection uses unsupervised clustering algorithms.
B. Novelty detection looks exclusively for single-point outliers, while anomaly detection looks exclusively for contextual outliers.
C. Anomaly detection only works with labeled data, while novelty detection is purely an unsupervised approach.
D. Novelty detection assumes the training data is clean and identifies new, unseen observations that differ from it, whereas anomaly detection expects outliers within the training data itself.

33 A machine learning system is trained entirely on normal, benign server network traffic. Once deployed, it monitors real-time traffic and flags any unseen pattern as a potential intrusion. This paradigm is best described as:

Anomaly Detection: Anomaly vs. novelty detection Medium
A. Contextual anomaly detection
B. Novelty detection
C. Density-based clustering
D. Association rule mining

34 In an Isolation Forest model, how are anomalies predominantly identified?

Isolation Forest Medium
A. By calculating the highest local density of data points around them.
B. By measuring their minimal Euclidean distance to the nearest cluster centroid.
C. By having the shortest average path lengths from the root to the leaf in the isolation trees.
D. By having the longest path lengths from the root to the leaf in the isolation trees.

35 Why is the Isolation Forest algorithm particularly efficient and well-suited for high-dimensional datasets compared to nearest-neighbor approaches?

Isolation Forest Medium
A. It requires computing exact distance metrics for all pairs of points.
B. It relies on random feature selection and split values, completely avoiding expensive distance calculations.
C. It explicitly projects all data into a two-dimensional space before finding anomalies.
D. It uses Principal Component Analysis (PCA) internally to reduce dimensions before building the trees.

36 In the Isolation Forest algorithm, the anomaly score is calculated using . If a point has an expected path length exactly equal to the average path length , what does its anomaly score evaluate to, and what does it signify?

Isolation Forest Medium
A. ; the point is a mathematical outlier.
B. ; the point does not have any distinct anomaly characteristics.
C. ; the point is a strong inlier.
D. ; the point is definitely an anomaly.

37 The Local Outlier Factor (LOF) algorithm determines whether a data point is an outlier by primarily evaluating:

Local Outlier Factor (LOF) Medium
A. The point's absolute Euclidean distance to the global mean of the dataset.
B. The sum of squared errors between the point and its assigned cluster centroid.
C. The point's local density compared to the local densities of its -nearest neighbors.
D. The point's isolation depth within a set of randomly constructed binary trees.

38 What is the typical interpretation when a data point yields an LOF score significantly greater than 1?

Local Outlier Factor (LOF) Medium
A. The point represents the exact centroid of a well-defined cluster.
B. The point has a lower local density than its neighbors, strongly suggesting it is an outlier.
C. The point has an identical local density to its neighbors.
D. The point is located in a significantly denser region than its neighbors (a strong inlier).

39 When utilizing unsupervised anomaly detection algorithms (like Isolation Forest) for credit card fraud detection, what is a primary operational challenge?

Applications in Cybersecurity and Fraud Detection Medium
A. The algorithm typically memorizes fraudulent transactions since they dominate the dataset.
B. The models require thousands of explicitly labeled fraudulent examples to initialize the random trees.
C. Unsupervised models are strictly incapable of processing numerical transaction amounts.
D. Rare but completely legitimate customer behaviors might be flagged, leading to a high false-positive rate.

40 In detecting unauthorized access attempts on a corporate network, why might the Local Outlier Factor (LOF) method be preferred over a global distance-based statistical method?

Applications in Cybersecurity and Fraud Detection Medium
A. LOF can identify localized anomalies (e.g., weird traffic relative only to the HR department), which global methods might gloss over as normal overall traffic.
B. Global methods process data too slowly to be used in real-time cybersecurity environments.
C. LOF utilizes an isolation tree structure that naturally maps directly to standard IP address subnets.
D. LOF requires strictly labeled training data, ensuring a higher precision in identifying specific known malware.

41 Given two itemsets and with support values and , what is the maximum theoretically possible value of , and what does it imply about the itemsets?

Lift Hard
A. 1.00; and are mutually exclusive.
B. 2.00; and always occur together.
C. 1.25; is a perfect subset of in the transaction database.
D. 1.25; and are perfectly independent.

42 Assume the confidence of the rule is and the confidence of the rule is . Which of the following represents the tightest mathematically guaranteed lower bound for the confidence of the rule ?

Confidence Hard
A.
B.
C.
D.

43 Consider two mutually exclusive itemsets and in a dataset where and . What is the conviction of the rule ?

Conviction Hard
A.
B.
C.
D.

44 During the candidate generation step () of the Apriori algorithm, let . Assuming lexicographic ordering, how many candidate 3-itemsets () are generated before the pruning step, and how many remain after the pruning step?

Apriori Algorithm Hard
A. Generated: 3, Remaining: 2
B. Generated: 4, Remaining: 2
C. Generated: 4, Remaining: 1
D. Generated: 3, Remaining: 1

45 Which of the following scenarios describes the worst-case space complexity for the FP-Tree constructed by the FP-Growth algorithm?

FP-Growth algorithm Hard
A. The dataset contains highly correlated, frequently co-occurring itemsets.
B. Every transaction contains exactly the same items.
C. Every transaction contains entirely distinct items, sharing no common prefixes.
D. The dataset follows a strict power-law distribution for item frequencies.

46 In the Local Outlier Factor (LOF) algorithm, what happens to the LOF score of a point if it is placed perfectly inside a uniform, highly dense cluster where the distance between all adjacent points is a microscopic constant ?

Local Outlier Factor (LOF) Hard
A. The LOF score approaches 0, identifying it as an extreme inlier.
B. The LOF score approaches due to division by zero in reachability distance.
C. The LOF score approaches 1, as its local reachability density matches its neighbors' densities.
D. The LOF score oscillates unpredictably depending on the value of .

47 The anomaly score in an Isolation Forest is given by . If a specific data point evaluates to a score of across a large number of trees, what is the correct interpretation regarding ?

Isolation Forest Hard
A. Point is highly anomalous, as its expected path length is half the maximum possible depth.
B. Point is isolated perfectly at the root node in half of the trees.
C. Point is a novelty introduced during inference, completely unrepresented in the training space.
D. Point is definitively a normal instance, as its expected path length matches the average path length of an unsuccessful search in a BST.

48 A data scientist is modeling network traffic to flag intrusions. The training data is known to be 'polluted' with a small fraction of unidentified malicious packets. Which algorithmic approach and paradigm is mathematically most robust for this specific training condition?

Anomaly vs. novelty detection Hard
A. Novelty Detection using a standard One-Class SVM with a hard margin.
B. Supervised Binary Classification using highly imbalanced Random Forests.
C. Novelty Detection using an Isolation Forest trained on clean baseline data.
D. Anomaly Detection using an Isolation Forest or a soft-margin One-Class SVM (e.g., using a hyperparameter).

49 Fraudsters often attempt an 'evasion attack' against LOF-based fraud detection systems by creating dense 'Sybil' clusters—a tightly knit group of fraudulent accounts that exhibit identical, highly correlated transaction behaviors. How does this attack mathematically exploit the Local Outlier Factor (LOF)?

Applications in Cybersecurity and Fraud Detection Hard
A. The attack creates an infinite loop in the LOF neighborhood search, causing a denial-of-service in the fraud detection system.
B. By forming a dense cluster, their -distances shrink to near zero, making their local reachability density equal to that of their neighbors, yielding an LOF .
C. The attack artificially inflates the LOF score of the honest users, causing them to be banned instead.
D. By increasing their collective distance from the origin, they force LOF to normalize their scores to 0.

50 In Market Basket Analysis, a retailer wants to optimize cross-selling campaigns by choosing between two rules: (Lift = 3.0, Support = 2%) and (Lift = 1.5, Support = 10%). If the sole objective is to maximize the absolute number of additional expected transactions driven by the rule (above random chance), which rule should be selected and why?

Market Basket Analysis Hard
A. Rule , because the product of Lift and Support is higher.
B. Rule , because it has a higher support, meaning it covers more total transactions regardless of Lift.
C. Rule , because a higher Lift guarantees a higher conditional probability of purchase.
D. It cannot be determined without knowing the Leverage or the absolute probabilities of individual items.

51 A dataset contains 1,000,000 transactions, out of which 990,000 are 'null transactions' that contain neither item A nor item B. If we remove all 990,000 null transactions to create a filtered dataset, which of the following metrics for the rule remains perfectly invariant?

Support Hard
A. Leverage of the rule
B. Support of the rule
C. Lift of the rule
D. Confidence of the rule

52 An Isolation Forest algorithm struggles to isolate a specific point anomaly in a dataset with 50 dimensions. Investigation reveals the anomaly is easily linearly separable but hidden within a complex linear combination of 10 heavily correlated features. Why does the standard Isolation Forest fail here?

Isolation Forest Hard
A. The expected path length diverges to infinity when features are heavily correlated.
B. The sub-sampling parameter is too low to capture 50 dimensions simultaneously.
C. Isolation Forests calculate Euclidean distances, which suffer from the curse of dimensionality.
D. Isolation Forest relies on strict axis-parallel splits, making it blind to anomalies defined solely by non-axis-aligned linear combinations.

53 The Apriori property (anti-monotonicity) states that if an itemset is frequent, all its subsets must be frequent. Suppose a researcher modifies the definition of a transaction such that it includes 'negative items' (e.g., a transaction contains if item A was deliberately not bought). Does the Apriori property still mathematically hold for mining itemsets containing both positive and negative items?

Apriori Algorithm Hard
A. Yes, but only if the minimum support threshold is set higher than $0.5$ to account for the high frequency of negative items.
B. No, the introduction of negative items breaks the subset probability axiom, making anti-monotonicity fail.
C. No, because is inversely proportional to , causing the support counts to oscillate.
D. Yes, because a negative item can simply be treated as a unique, distinct item, and the subset probability bounds still fundamentally apply.

54 During the recursive mining of the FP-Tree, the algorithm constructs 'Conditional Pattern Bases'. For a heavily skewed dataset where a single frequent item appears in 95% of all transactions, where will typically be located in the conditional pattern bases of other items?

FP-Growth algorithm Hard
A. It will not appear in any conditional pattern bases, as its frequency causes it to be pruned early.
B. It will frequently appear as a single-node path near the root of the conditional trees, leading to highly efficient compression.
C. It will force the algorithm to fall back to an Apriori-like candidate generation to handle the skewness.
D. It will appear frequently at the leaves of the conditional trees, causing high memory overhead.

55 A fraud detection system evaluates credit card transactions. Let a rule be . Given the extreme class imbalance (Fraud is of all transactions), which of the following statements about rule evaluation metrics is mathematically true?

Applications in Cybersecurity and Fraud Detection Hard
A. Conviction will approach zero, rendering it useless for asymmetric rules.
B. Leverage will be mathematically maximized because is near zero.
C. Lift will likely be extremely high even if the rule generates many false positives, suffering from the Base Rate Fallacy.
D. Confidence is an unbiased estimator for fraud likelihood, unaffected by class imbalance.

56 Let and be itemsets. If , which of the following logical equivalences is definitively true regarding the transaction database?

Support Hard
A. Every transaction that contains must also contain .
B. and are identical itemsets.
C. Every transaction that contains must also contain .
D. The dataset contains no null transactions.

57 In the context of the exact mathematical objective functions, how does a One-Class SVM (used for Novelty Detection) fundamentally differ from standard PCA-based reconstruction error (used for Anomaly Detection)?

Anomaly vs. novelty detection Hard
A. One-Class SVM maximizes the margin separating data from the origin, whereas PCA minimizes orthogonal projection loss.
B. One-Class SVM minimizes a volume enclosing the training data origin, whereas PCA minimizes orthogonal projection loss.
C. One-Class SVM relies on Gaussian distributions, whereas PCA is non-parametric.
D. There is no difference; both project data onto a lower-dimensional hyperplane optimized for variance.

58 Consider the edge case in calculating the Local Outlier Factor (LOF) where a dataset contains identical duplicate instances. If there are perfectly identical points and the neighborhood parameter is set such that , what critical computational failure occurs natively in the standard LOF definition?

Local Outlier Factor (LOF) Hard
A. The Reachability Distance reduces to the Manhattan distance, ignoring local density structures.
B. The points form an infinite loop during the nearest-neighbor search, halting the algorithm.
C. The algorithm identifies all points as outliers because their LOF score becomes infinite.
D. The -distance of these identical points evaluates to zero, causing a division by zero when calculating the Local Reachability Density (lrd).

59 Which of the following conditions proves that is mathematically symmetric (i.e., )?

Lift Hard
A. It is only true when .
B. It is only true when .
C. It is only true when and are statistically independent.
D. It is always true by the definition of the formula.

60 A supermarket analyzes baskets containing {Bread, Butter, Jam}. They observe the rule has and . However, the rule has and . According to Market Basket Analysis principles, what does this mathematically reveal about the relationship?

Market Basket Analysis Hard
A. Bread and Butter are mutually exclusive items.
B. The dataset suffers from the base-rate fallacy regarding the purchase of Jam.
C. The itemsets violate the Apriori anti-monotonicity property, indicating a calculation error.
D. Butter is an 'anti-catalyst' for buying Jam when Bread is already in the basket.
Previous MCQ
Unit 4
Next MCQ
Unit 6