Back to Subject

Unit 5 - Practice Quiz

INT396 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 In association rule mining, what does the 'Support' metric measure?

Support Easy
A. The probability that a rule is incorrect.
B. The error rate of the generated association rules.
C. The ratio of independent occurrences of two itemsets.
D. The frequency or proportion of transactions that contain a specific itemset.

2 How is the Confidence of an association rule mathematically defined?

Confidence Easy
A.
B.
C.
D.

3 What does a high confidence score for the rule {Bread} {Butter} indicate?

Confidence Easy
A. Customers who buy Bread are highly likely to also buy Butter.
B. Customers who buy Butter are highly likely to buy Bread.
C. Bread and Butter are always bought independently.
D. Bread and Butter are the most popular items in the store.

4 What does a Lift value greater than 1 indicate for an association rule ?

Lift Easy
A. The rule is invalid and should be discarded.
B. X and Y are completely independent of each other.
C. A negative correlation, meaning X and Y appear together less often than expected.
D. A positive correlation, meaning X and Y appear together more often than expected by chance.

5 Which metric evaluates the ratio of the observed support of to the expected support if X and Y were independent?

Lift Easy
A. Confidence
B. Conviction
C. Support
D. Lift

6 What is the primary purpose of the 'Conviction' metric in association rule mining?

Conviction Easy
A. To determine the speed of the Apriori algorithm.
B. To measure the ratio of the expected frequency that X occurs without Y (if independent) to the observed frequency of X occurring without Y.
C. To compress the dataset into a tree structure.
D. To measure the absolute frequency of an itemset in the database.

7 What is the core idea behind the Apriori principle?

Apriori Algorithm Easy
A. If an itemset is frequent, then all of its supersets must also be frequent.
B. If an itemset is frequent, then all of its subsets must also be frequent.
C. Association rules can only contain two items.
D. Infrequent itemsets can have frequent supersets.

8 What happens during the 'candidate generation' step of the Apriori algorithm?

Apriori Algorithm Easy
A. The dataset is clustered into groups based on similarity.
B. A tree data structure is built to avoid scanning the database.
C. Anomalies in the transaction records are removed.
D. Larger itemsets (candidates) are created by joining smaller frequent itemsets from the previous pass.

9 Which property allows the Apriori algorithm to prune the search space efficiently?

Apriori Algorithm Easy
A. Monotonicity of confidence
B. Curse of dimensionality
C. Anti-monotone property of support
D. Triangle inequality

10 What is a major advantage of the FP-Growth algorithm over the Apriori algorithm?

FP-Growth algorithm Easy
A. It does not require candidate generation.
B. It requires multiple scans of the database for every itemset size.
C. It generates association rules without calculating support.
D. It is only applicable to continuous numerical data.

11 Which data structure is uniquely utilized by the FP-Growth algorithm to compress database transactions?

FP-Growth algorithm Easy
A. Binary Search Tree
B. FP-Tree (Frequent Pattern Tree)
C. KD-Tree
D. B-Tree

12 What is the primary business goal of Market Basket Analysis?

Market Basket Analysis Easy
A. To identify combinations of products that are frequently bought together.
B. To classify customers based on their age and income.
C. To predict the exact total price of a customer's basket.
D. To detect credit card fraud at checkout.

13 Which of the following scenarios is a classic application of Market Basket Analysis?

Market Basket Analysis Easy
A. Filtering spam emails out of an inbox.
B. Placing diapers and beer near each other in a supermarket based on past purchasing data.
C. Classifying images of cats and dogs.
D. Predicting future housing prices based on square footage.

14 What is the main difference between anomaly detection and novelty detection?

Anomaly Detection: Anomaly vs. novelty detection Easy
A. Novelty detection finds frequent items, while anomaly detection finds association rules.
B. There is no difference; they are exactly the same concept in all contexts.
C. Novelty detection assumes the training data has no outliers, while anomaly detection assumes training data may contain outliers.
D. Novelty detection is supervised learning, while anomaly detection is reinforcement learning.

15 In the context of machine learning, how is an 'anomaly' defined?

Anomaly Detection: Anomaly vs. novelty detection Easy
A. The most frequently occurring data point in a dataset.
B. A data point that differs significantly from the majority of other observations.
C. A missing value in a dataset.
D. The average or mean value of a particular feature.

16 How does the Isolation Forest algorithm identify anomalies?

Isolation Forest Easy
A. Anomalies require fewer random splits (shorter path lengths) to be isolated in a tree.
B. Anomalies require more random splits (longer path lengths) to be isolated.
C. It isolates data points based on their frequency in an FP-Tree.
D. It calculates the Euclidean distance to the nearest neighbor.

17 The Isolation Forest algorithm is fundamentally based on which type of machine learning structure?

Isolation Forest Easy
A. K-Means Clustering
B. Artificial Neural Networks
C. Support Vector Machines
D. Decision Trees

18 What core concept does the Local Outlier Factor (LOF) algorithm use to find anomalies?

Local Outlier Factor (LOF) Easy
A. It counts the absolute number of points in a given radius globally.
B. It compares the local density of a data point to the local densities of its neighbors.
C. It calculates the length of paths in a forest of random trees.
D. It calculates the support and confidence of items in transactions.

19 If a data point has an LOF score significantly greater than 1, what does this typically imply?

Local Outlier Factor (LOF) Easy
A. The point is likely an outlier or anomaly.
B. The point is perfectly normal (an inlier).
C. The point is part of a frequent itemset.
D. The point is the exact center of a cluster.

20 Why is unsupervised anomaly detection particularly useful in cybersecurity (e.g., intrusion detection)?

Applications in Cybersecurity and Fraud Detection Easy
A. It encrypts all incoming and outgoing network traffic.
B. It can detect new, previously unknown attacks (zero-day threats) without needing labeled examples of those attacks.
C. It automatically repairs all software vulnerabilities.
D. It uses labeled data to perfectly classify known viruses.

21 In a dataset of 200 transactions, itemset appears 60 times, itemset appears 80 times, and both and appear together in 30 transactions. What is the support of the rule ?

Support Medium
A. 0.50
B. 0.30
C. 0.15
D. 0.375

22 Suppose the support of itemset is 0.20, the support of itemset is 0.40, and the support of is 0.15. What is the confidence of the association rule ?

Confidence Medium
A. 0.60
B. 0.375
C. 0.15
D. 0.75

23 For the association rule , the confidence is 0.8 and the support of in the entire dataset is 0.4. What is the Lift of this rule, and what does it indicate?

Lift Medium
A. Lift = 1.2; and are independent.
B. Lift = 0.5; and are negatively correlated.
C. Lift = 2.0; and are negatively correlated.
D. Lift = 2.0; and are positively correlated.

24 A lift value of 0.6 for the rule implies what about the relationship between items and ?

Lift Medium
A. They are completely independent of each other.
B. always appears whenever appears in a transaction.
C. They are negatively correlated, meaning they act as substitutes.
D. The presence of increases the likelihood of occurring.

25 The rule has a confidence of 0.75. If the overall probability of occurring in the dataset is 0.5, what is the conviction of this rule?

Conviction Medium
A. 1.0
B. 0.5
C. 2.0
D. 1.5

26 The Apriori algorithm relies heavily on the anti-monotone property of support. Which of the following best describes this property?

Apriori Algorithm Medium
A. If an itemset is frequent, all its supersets must also be frequent.
B. Confidence is always strictly greater than or equal to support.
C. If an itemset is infrequent, all its supersets must be infrequent.
D. The support of an itemset is always equal to the sum of the supports of its subsets.

27 During the candidate generation step of the Apriori algorithm, if a candidate 3-itemset is , what condition must be met for it to survive the pruning step?

Apriori Algorithm Medium
A. Only the subset needs to be present in .
B. All of its 2-item subsets () must be present in the set of frequent 2-itemsets ().
C. At least one of its 2-item subsets must be in the set of frequent 2-itemsets ().
D. It must have a confidence greater than its support.

28 How does the FP-Growth algorithm primarily improve upon the efficiency of the Apriori algorithm?

FP-Growth algorithm Medium
A. It generates candidates using a join step without a computationally expensive pruning phase.
B. It processes the database using an SQL JOIN instead of traditional looping.
C. It builds a compact tree structure and extracts frequent itemsets without explicit candidate generation.
D. It uses confidence thresholds instead of support to drastically reduce the search space.

29 When constructing an FP-Tree, the items within each scanned transaction are sorted before insertion. What is the standard sorting order used?

FP-Growth algorithm Medium
A. Increasing order of their global support frequencies.
B. The order in which they physically appear in the original database.
C. Decreasing order of their global support frequencies.
D. Alphabetical or lexicographical order.

30 In Market Basket Analysis, if the rule has high support but a lift close to 1.0, what does this indicate to a retailer?

Market Basket Analysis Medium
A. The co-occurrence of Milk and Bread is largely due to their high individual frequencies, not a strong specific association.
B. Buying Milk actively prevents the customer from buying Bread.
C. Customers almost never buy both items together in a single trip.
D. Milk and Bread are highly dependent on each other; a discount on one drives the other.

31 When designing promotional strategies using Market Basket Analysis, a high confidence for the rule suggests that:

Market Basket Analysis Medium
A. Discounting Batteries will definitively cause a massive spike in Flashlight sales.
B. Flashlights and Batteries should be placed far apart to encourage impulse buying.
C. Batteries are the most frequently purchased item in the store.
D. Most transactions that contain a Flashlight also contain Batteries.

32 Which of the following best distinguishes novelty detection from standard anomaly detection?

Anomaly Detection: Anomaly vs. novelty detection Medium
A. Novelty detection uses supervised decision trees, whereas anomaly detection uses unsupervised clustering algorithms.
B. Novelty detection assumes the training data is clean and identifies new, unseen observations that differ from it, whereas anomaly detection expects outliers within the training data itself.
C. Novelty detection looks exclusively for single-point outliers, while anomaly detection looks exclusively for contextual outliers.
D. Anomaly detection only works with labeled data, while novelty detection is purely an unsupervised approach.

33 A machine learning system is trained entirely on normal, benign server network traffic. Once deployed, it monitors real-time traffic and flags any unseen pattern as a potential intrusion. This paradigm is best described as:

Anomaly Detection: Anomaly vs. novelty detection Medium
A. Density-based clustering
B. Contextual anomaly detection
C. Association rule mining
D. Novelty detection

34 In an Isolation Forest model, how are anomalies predominantly identified?

Isolation Forest Medium
A. By measuring their minimal Euclidean distance to the nearest cluster centroid.
B. By having the shortest average path lengths from the root to the leaf in the isolation trees.
C. By calculating the highest local density of data points around them.
D. By having the longest path lengths from the root to the leaf in the isolation trees.

35 Why is the Isolation Forest algorithm particularly efficient and well-suited for high-dimensional datasets compared to nearest-neighbor approaches?

Isolation Forest Medium
A. It requires computing exact distance metrics for all pairs of points.
B. It relies on random feature selection and split values, completely avoiding expensive distance calculations.
C. It uses Principal Component Analysis (PCA) internally to reduce dimensions before building the trees.
D. It explicitly projects all data into a two-dimensional space before finding anomalies.

36 In the Isolation Forest algorithm, the anomaly score is calculated using . If a point has an expected path length exactly equal to the average path length , what does its anomaly score evaluate to, and what does it signify?

Isolation Forest Medium
A. ; the point is a strong inlier.
B. ; the point is a mathematical outlier.
C. ; the point is definitely an anomaly.
D. ; the point does not have any distinct anomaly characteristics.

37 The Local Outlier Factor (LOF) algorithm determines whether a data point is an outlier by primarily evaluating:

Local Outlier Factor (LOF) Medium
A. The point's local density compared to the local densities of its -nearest neighbors.
B. The sum of squared errors between the point and its assigned cluster centroid.
C. The point's isolation depth within a set of randomly constructed binary trees.
D. The point's absolute Euclidean distance to the global mean of the dataset.

38 What is the typical interpretation when a data point yields an LOF score significantly greater than 1?

Local Outlier Factor (LOF) Medium
A. The point is located in a significantly denser region than its neighbors (a strong inlier).
B. The point has an identical local density to its neighbors.
C. The point has a lower local density than its neighbors, strongly suggesting it is an outlier.
D. The point represents the exact centroid of a well-defined cluster.

39 When utilizing unsupervised anomaly detection algorithms (like Isolation Forest) for credit card fraud detection, what is a primary operational challenge?

Applications in Cybersecurity and Fraud Detection Medium
A. The models require thousands of explicitly labeled fraudulent examples to initialize the random trees.
B. Rare but completely legitimate customer behaviors might be flagged, leading to a high false-positive rate.
C. Unsupervised models are strictly incapable of processing numerical transaction amounts.
D. The algorithm typically memorizes fraudulent transactions since they dominate the dataset.

40 In detecting unauthorized access attempts on a corporate network, why might the Local Outlier Factor (LOF) method be preferred over a global distance-based statistical method?

Applications in Cybersecurity and Fraud Detection Medium
A. LOF utilizes an isolation tree structure that naturally maps directly to standard IP address subnets.
B. LOF requires strictly labeled training data, ensuring a higher precision in identifying specific known malware.
C. LOF can identify localized anomalies (e.g., weird traffic relative only to the HR department), which global methods might gloss over as normal overall traffic.
D. Global methods process data too slowly to be used in real-time cybersecurity environments.

41 Given two itemsets and with support values and , what is the maximum theoretically possible value of , and what does it imply about the itemsets?

Lift Hard
A. 1.25; is a perfect subset of in the transaction database.
B. 2.00; and always occur together.
C. 1.25; and are perfectly independent.
D. 1.00; and are mutually exclusive.

42 Assume the confidence of the rule is and the confidence of the rule is . Which of the following represents the tightest mathematically guaranteed lower bound for the confidence of the rule ?

Confidence Hard
A.
B.
C.
D.

43 Consider two mutually exclusive itemsets and in a dataset where and . What is the conviction of the rule ?

Conviction Hard
A.
B.
C.
D.

44 During the candidate generation step () of the Apriori algorithm, let . Assuming lexicographic ordering, how many candidate 3-itemsets () are generated before the pruning step, and how many remain after the pruning step?

Apriori Algorithm Hard
A. Generated: 4, Remaining: 2
B. Generated: 3, Remaining: 1
C. Generated: 4, Remaining: 1
D. Generated: 3, Remaining: 2

45 Which of the following scenarios describes the worst-case space complexity for the FP-Tree constructed by the FP-Growth algorithm?

FP-Growth algorithm Hard
A. Every transaction contains exactly the same items.
B. The dataset follows a strict power-law distribution for item frequencies.
C. Every transaction contains entirely distinct items, sharing no common prefixes.
D. The dataset contains highly correlated, frequently co-occurring itemsets.

46 In the Local Outlier Factor (LOF) algorithm, what happens to the LOF score of a point if it is placed perfectly inside a uniform, highly dense cluster where the distance between all adjacent points is a microscopic constant ?

Local Outlier Factor (LOF) Hard
A. The LOF score oscillates unpredictably depending on the value of .
B. The LOF score approaches due to division by zero in reachability distance.
C. The LOF score approaches 1, as its local reachability density matches its neighbors' densities.
D. The LOF score approaches 0, identifying it as an extreme inlier.

47 The anomaly score in an Isolation Forest is given by . If a specific data point evaluates to a score of across a large number of trees, what is the correct interpretation regarding ?

Isolation Forest Hard
A. Point is highly anomalous, as its expected path length is half the maximum possible depth.
B. Point is isolated perfectly at the root node in half of the trees.
C. Point is definitively a normal instance, as its expected path length matches the average path length of an unsuccessful search in a BST.
D. Point is a novelty introduced during inference, completely unrepresented in the training space.

48 A data scientist is modeling network traffic to flag intrusions. The training data is known to be 'polluted' with a small fraction of unidentified malicious packets. Which algorithmic approach and paradigm is mathematically most robust for this specific training condition?

Anomaly vs. novelty detection Hard
A. Supervised Binary Classification using highly imbalanced Random Forests.
B. Anomaly Detection using an Isolation Forest or a soft-margin One-Class SVM (e.g., using a hyperparameter).
C. Novelty Detection using an Isolation Forest trained on clean baseline data.
D. Novelty Detection using a standard One-Class SVM with a hard margin.

49 Fraudsters often attempt an 'evasion attack' against LOF-based fraud detection systems by creating dense 'Sybil' clusters—a tightly knit group of fraudulent accounts that exhibit identical, highly correlated transaction behaviors. How does this attack mathematically exploit the Local Outlier Factor (LOF)?

Applications in Cybersecurity and Fraud Detection Hard
A. By forming a dense cluster, their -distances shrink to near zero, making their local reachability density equal to that of their neighbors, yielding an LOF .
B. By increasing their collective distance from the origin, they force LOF to normalize their scores to 0.
C. The attack creates an infinite loop in the LOF neighborhood search, causing a denial-of-service in the fraud detection system.
D. The attack artificially inflates the LOF score of the honest users, causing them to be banned instead.

50 In Market Basket Analysis, a retailer wants to optimize cross-selling campaigns by choosing between two rules: (Lift = 3.0, Support = 2%) and (Lift = 1.5, Support = 10%). If the sole objective is to maximize the absolute number of additional expected transactions driven by the rule (above random chance), which rule should be selected and why?

Market Basket Analysis Hard
A. Rule , because a higher Lift guarantees a higher conditional probability of purchase.
B. Rule , because the product of Lift and Support is higher.
C. It cannot be determined without knowing the Leverage or the absolute probabilities of individual items.
D. Rule , because it has a higher support, meaning it covers more total transactions regardless of Lift.

51 A dataset contains 1,000,000 transactions, out of which 990,000 are 'null transactions' that contain neither item A nor item B. If we remove all 990,000 null transactions to create a filtered dataset, which of the following metrics for the rule remains perfectly invariant?

Support Hard
A. Confidence of the rule
B. Lift of the rule
C. Leverage of the rule
D. Support of the rule

52 An Isolation Forest algorithm struggles to isolate a specific point anomaly in a dataset with 50 dimensions. Investigation reveals the anomaly is easily linearly separable but hidden within a complex linear combination of 10 heavily correlated features. Why does the standard Isolation Forest fail here?

Isolation Forest Hard
A. Isolation Forest relies on strict axis-parallel splits, making it blind to anomalies defined solely by non-axis-aligned linear combinations.
B. The expected path length diverges to infinity when features are heavily correlated.
C. The sub-sampling parameter is too low to capture 50 dimensions simultaneously.
D. Isolation Forests calculate Euclidean distances, which suffer from the curse of dimensionality.

53 The Apriori property (anti-monotonicity) states that if an itemset is frequent, all its subsets must be frequent. Suppose a researcher modifies the definition of a transaction such that it includes 'negative items' (e.g., a transaction contains if item A was deliberately not bought). Does the Apriori property still mathematically hold for mining itemsets containing both positive and negative items?

Apriori Algorithm Hard
A. No, because is inversely proportional to , causing the support counts to oscillate.
B. Yes, because a negative item can simply be treated as a unique, distinct item, and the subset probability bounds still fundamentally apply.
C. No, the introduction of negative items breaks the subset probability axiom, making anti-monotonicity fail.
D. Yes, but only if the minimum support threshold is set higher than $0.5$ to account for the high frequency of negative items.

54 During the recursive mining of the FP-Tree, the algorithm constructs 'Conditional Pattern Bases'. For a heavily skewed dataset where a single frequent item appears in 95% of all transactions, where will typically be located in the conditional pattern bases of other items?

FP-Growth algorithm Hard
A. It will not appear in any conditional pattern bases, as its frequency causes it to be pruned early.
B. It will frequently appear as a single-node path near the root of the conditional trees, leading to highly efficient compression.
C. It will appear frequently at the leaves of the conditional trees, causing high memory overhead.
D. It will force the algorithm to fall back to an Apriori-like candidate generation to handle the skewness.

55 A fraud detection system evaluates credit card transactions. Let a rule be . Given the extreme class imbalance (Fraud is of all transactions), which of the following statements about rule evaluation metrics is mathematically true?

Applications in Cybersecurity and Fraud Detection Hard
A. Lift will likely be extremely high even if the rule generates many false positives, suffering from the Base Rate Fallacy.
B. Conviction will approach zero, rendering it useless for asymmetric rules.
C. Leverage will be mathematically maximized because is near zero.
D. Confidence is an unbiased estimator for fraud likelihood, unaffected by class imbalance.

56 Let and be itemsets. If , which of the following logical equivalences is definitively true regarding the transaction database?

Support Hard
A. and are identical itemsets.
B. The dataset contains no null transactions.
C. Every transaction that contains must also contain .
D. Every transaction that contains must also contain .

57 In the context of the exact mathematical objective functions, how does a One-Class SVM (used for Novelty Detection) fundamentally differ from standard PCA-based reconstruction error (used for Anomaly Detection)?

Anomaly vs. novelty detection Hard
A. There is no difference; both project data onto a lower-dimensional hyperplane optimized for variance.
B. One-Class SVM minimizes a volume enclosing the training data origin, whereas PCA minimizes orthogonal projection loss.
C. One-Class SVM relies on Gaussian distributions, whereas PCA is non-parametric.
D. One-Class SVM maximizes the margin separating data from the origin, whereas PCA minimizes orthogonal projection loss.

58 Consider the edge case in calculating the Local Outlier Factor (LOF) where a dataset contains identical duplicate instances. If there are perfectly identical points and the neighborhood parameter is set such that , what critical computational failure occurs natively in the standard LOF definition?

Local Outlier Factor (LOF) Hard
A. The Reachability Distance reduces to the Manhattan distance, ignoring local density structures.
B. The -distance of these identical points evaluates to zero, causing a division by zero when calculating the Local Reachability Density (lrd).
C. The algorithm identifies all points as outliers because their LOF score becomes infinite.
D. The points form an infinite loop during the nearest-neighbor search, halting the algorithm.

59 Which of the following conditions proves that is mathematically symmetric (i.e., )?

Lift Hard
A. It is only true when .
B. It is only true when .
C. It is always true by the definition of the formula.
D. It is only true when and are statistically independent.

60 A supermarket analyzes baskets containing {Bread, Butter, Jam}. They observe the rule has and . However, the rule has and . According to Market Basket Analysis principles, what does this mathematically reveal about the relationship?

Market Basket Analysis Hard
A. The dataset suffers from the base-rate fallacy regarding the purchase of Jam.
B. Butter is an 'anti-catalyst' for buying Jam when Bread is already in the basket.
C. The itemsets violate the Apriori anti-monotonicity property, indicating a calculation error.
D. Bread and Butter are mutually exclusive items.
Previous MCQ
Unit 4
Next MCQ
Unit 6