Back to Subject

Unit 5 - Practice Quiz

INT396 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 In association rule mining, what does the 'Support' metric measure?

Support Easy
A. The error rate of the generated association rules.
B. The frequency or proportion of transactions that contain a specific itemset.
C. The probability that a rule is incorrect.
D. The ratio of independent occurrences of two itemsets.

2 How is the Confidence of an association rule mathematically defined?

Confidence Easy
A.
B.
C.
D.

3 What does a high confidence score for the rule {Bread} {Butter} indicate?

Confidence Easy
A. Customers who buy Butter are highly likely to buy Bread.
B. Bread and Butter are always bought independently.
C. Bread and Butter are the most popular items in the store.
D. Customers who buy Bread are highly likely to also buy Butter.

4 What does a Lift value greater than 1 indicate for an association rule ?

Lift Easy
A. The rule is invalid and should be discarded.
B. A positive correlation, meaning X and Y appear together more often than expected by chance.
C. X and Y are completely independent of each other.
D. A negative correlation, meaning X and Y appear together less often than expected.

5 Which metric evaluates the ratio of the observed support of to the expected support if X and Y were independent?

Lift Easy
A. Confidence
B. Lift
C. Conviction
D. Support

6 What is the primary purpose of the 'Conviction' metric in association rule mining?

Conviction Easy
A. To measure the ratio of the expected frequency that X occurs without Y (if independent) to the observed frequency of X occurring without Y.
B. To compress the dataset into a tree structure.
C. To measure the absolute frequency of an itemset in the database.
D. To determine the speed of the Apriori algorithm.

7 What is the core idea behind the Apriori principle?

Apriori Algorithm Easy
A. Infrequent itemsets can have frequent supersets.
B. If an itemset is frequent, then all of its subsets must also be frequent.
C. If an itemset is frequent, then all of its supersets must also be frequent.
D. Association rules can only contain two items.

8 What happens during the 'candidate generation' step of the Apriori algorithm?

Apriori Algorithm Easy
A. A tree data structure is built to avoid scanning the database.
B. The dataset is clustered into groups based on similarity.
C. Larger itemsets (candidates) are created by joining smaller frequent itemsets from the previous pass.
D. Anomalies in the transaction records are removed.

9 Which property allows the Apriori algorithm to prune the search space efficiently?

Apriori Algorithm Easy
A. Triangle inequality
B. Curse of dimensionality
C. Anti-monotone property of support
D. Monotonicity of confidence

10 What is a major advantage of the FP-Growth algorithm over the Apriori algorithm?

FP-Growth algorithm Easy
A. It generates association rules without calculating support.
B. It requires multiple scans of the database for every itemset size.
C. It is only applicable to continuous numerical data.
D. It does not require candidate generation.

11 Which data structure is uniquely utilized by the FP-Growth algorithm to compress database transactions?

FP-Growth algorithm Easy
A. Binary Search Tree
B. FP-Tree (Frequent Pattern Tree)
C. KD-Tree
D. B-Tree

12 What is the primary business goal of Market Basket Analysis?

Market Basket Analysis Easy
A. To identify combinations of products that are frequently bought together.
B. To predict the exact total price of a customer's basket.
C. To classify customers based on their age and income.
D. To detect credit card fraud at checkout.

13 Which of the following scenarios is a classic application of Market Basket Analysis?

Market Basket Analysis Easy
A. Predicting future housing prices based on square footage.
B. Filtering spam emails out of an inbox.
C. Classifying images of cats and dogs.
D. Placing diapers and beer near each other in a supermarket based on past purchasing data.

14 What is the main difference between anomaly detection and novelty detection?

Anomaly Detection: Anomaly vs. novelty detection Easy
A. There is no difference; they are exactly the same concept in all contexts.
B. Novelty detection is supervised learning, while anomaly detection is reinforcement learning.
C. Novelty detection finds frequent items, while anomaly detection finds association rules.
D. Novelty detection assumes the training data has no outliers, while anomaly detection assumes training data may contain outliers.

15 In the context of machine learning, how is an 'anomaly' defined?

Anomaly Detection: Anomaly vs. novelty detection Easy
A. The average or mean value of a particular feature.
B. The most frequently occurring data point in a dataset.
C. A missing value in a dataset.
D. A data point that differs significantly from the majority of other observations.

16 How does the Isolation Forest algorithm identify anomalies?

Isolation Forest Easy
A. It isolates data points based on their frequency in an FP-Tree.
B. Anomalies require fewer random splits (shorter path lengths) to be isolated in a tree.
C. Anomalies require more random splits (longer path lengths) to be isolated.
D. It calculates the Euclidean distance to the nearest neighbor.

17 The Isolation Forest algorithm is fundamentally based on which type of machine learning structure?

Isolation Forest Easy
A. Decision Trees
B. K-Means Clustering
C. Support Vector Machines
D. Artificial Neural Networks

18 What core concept does the Local Outlier Factor (LOF) algorithm use to find anomalies?

Local Outlier Factor (LOF) Easy
A. It calculates the length of paths in a forest of random trees.
B. It counts the absolute number of points in a given radius globally.
C. It calculates the support and confidence of items in transactions.
D. It compares the local density of a data point to the local densities of its neighbors.

19 If a data point has an LOF score significantly greater than 1, what does this typically imply?

Local Outlier Factor (LOF) Easy
A. The point is likely an outlier or anomaly.
B. The point is the exact center of a cluster.
C. The point is part of a frequent itemset.
D. The point is perfectly normal (an inlier).

20 Why is unsupervised anomaly detection particularly useful in cybersecurity (e.g., intrusion detection)?

Applications in Cybersecurity and Fraud Detection Easy
A. It can detect new, previously unknown attacks (zero-day threats) without needing labeled examples of those attacks.
B. It uses labeled data to perfectly classify known viruses.
C. It encrypts all incoming and outgoing network traffic.
D. It automatically repairs all software vulnerabilities.

21 In a dataset of 200 transactions, itemset appears 60 times, itemset appears 80 times, and both and appear together in 30 transactions. What is the support of the rule ?

Support Medium
A. 0.375
B. 0.50
C. 0.15
D. 0.30

22 Suppose the support of itemset is 0.20, the support of itemset is 0.40, and the support of is 0.15. What is the confidence of the association rule ?

Confidence Medium
A. 0.75
B. 0.375
C. 0.15
D. 0.60

23 For the association rule , the confidence is 0.8 and the support of in the entire dataset is 0.4. What is the Lift of this rule, and what does it indicate?

Lift Medium
A. Lift = 1.2; and are independent.
B. Lift = 2.0; and are positively correlated.
C. Lift = 2.0; and are negatively correlated.
D. Lift = 0.5; and are negatively correlated.

24 A lift value of 0.6 for the rule implies what about the relationship between items and ?

Lift Medium
A. They are negatively correlated, meaning they act as substitutes.
B. always appears whenever appears in a transaction.
C. The presence of increases the likelihood of occurring.
D. They are completely independent of each other.

25 The rule has a confidence of 0.75. If the overall probability of occurring in the dataset is 0.5, what is the conviction of this rule?

Conviction Medium
A. 1.5
B. 0.5
C. 2.0
D. 1.0

26 The Apriori algorithm relies heavily on the anti-monotone property of support. Which of the following best describes this property?

Apriori Algorithm Medium
A. Confidence is always strictly greater than or equal to support.
B. The support of an itemset is always equal to the sum of the supports of its subsets.
C. If an itemset is infrequent, all its supersets must be infrequent.
D. If an itemset is frequent, all its supersets must also be frequent.

27 During the candidate generation step of the Apriori algorithm, if a candidate 3-itemset is , what condition must be met for it to survive the pruning step?

Apriori Algorithm Medium
A. All of its 2-item subsets () must be present in the set of frequent 2-itemsets ().
B. At least one of its 2-item subsets must be in the set of frequent 2-itemsets ().
C. Only the subset needs to be present in .
D. It must have a confidence greater than its support.

28 How does the FP-Growth algorithm primarily improve upon the efficiency of the Apriori algorithm?

FP-Growth algorithm Medium
A. It uses confidence thresholds instead of support to drastically reduce the search space.
B. It generates candidates using a join step without a computationally expensive pruning phase.
C. It processes the database using an SQL JOIN instead of traditional looping.
D. It builds a compact tree structure and extracts frequent itemsets without explicit candidate generation.

29 When constructing an FP-Tree, the items within each scanned transaction are sorted before insertion. What is the standard sorting order used?

FP-Growth algorithm Medium
A. Alphabetical or lexicographical order.
B. The order in which they physically appear in the original database.
C. Decreasing order of their global support frequencies.
D. Increasing order of their global support frequencies.

30 In Market Basket Analysis, if the rule has high support but a lift close to 1.0, what does this indicate to a retailer?

Market Basket Analysis Medium
A. The co-occurrence of Milk and Bread is largely due to their high individual frequencies, not a strong specific association.
B. Customers almost never buy both items together in a single trip.
C. Milk and Bread are highly dependent on each other; a discount on one drives the other.
D. Buying Milk actively prevents the customer from buying Bread.

31 When designing promotional strategies using Market Basket Analysis, a high confidence for the rule suggests that:

Market Basket Analysis Medium
A. Discounting Batteries will definitively cause a massive spike in Flashlight sales.
B. Flashlights and Batteries should be placed far apart to encourage impulse buying.
C. Batteries are the most frequently purchased item in the store.
D. Most transactions that contain a Flashlight also contain Batteries.

32 Which of the following best distinguishes novelty detection from standard anomaly detection?

Anomaly Detection: Anomaly vs. novelty detection Medium
A. Anomaly detection only works with labeled data, while novelty detection is purely an unsupervised approach.
B. Novelty detection assumes the training data is clean and identifies new, unseen observations that differ from it, whereas anomaly detection expects outliers within the training data itself.
C. Novelty detection looks exclusively for single-point outliers, while anomaly detection looks exclusively for contextual outliers.
D. Novelty detection uses supervised decision trees, whereas anomaly detection uses unsupervised clustering algorithms.

33 A machine learning system is trained entirely on normal, benign server network traffic. Once deployed, it monitors real-time traffic and flags any unseen pattern as a potential intrusion. This paradigm is best described as:

Anomaly Detection: Anomaly vs. novelty detection Medium
A. Novelty detection
B. Density-based clustering
C. Association rule mining
D. Contextual anomaly detection

34 In an Isolation Forest model, how are anomalies predominantly identified?

Isolation Forest Medium
A. By calculating the highest local density of data points around them.
B. By having the longest path lengths from the root to the leaf in the isolation trees.
C. By having the shortest average path lengths from the root to the leaf in the isolation trees.
D. By measuring their minimal Euclidean distance to the nearest cluster centroid.

35 Why is the Isolation Forest algorithm particularly efficient and well-suited for high-dimensional datasets compared to nearest-neighbor approaches?

Isolation Forest Medium
A. It explicitly projects all data into a two-dimensional space before finding anomalies.
B. It uses Principal Component Analysis (PCA) internally to reduce dimensions before building the trees.
C. It requires computing exact distance metrics for all pairs of points.
D. It relies on random feature selection and split values, completely avoiding expensive distance calculations.

36 In the Isolation Forest algorithm, the anomaly score is calculated using . If a point has an expected path length exactly equal to the average path length , what does its anomaly score evaluate to, and what does it signify?

Isolation Forest Medium
A. ; the point is a mathematical outlier.
B. ; the point is definitely an anomaly.
C. ; the point does not have any distinct anomaly characteristics.
D. ; the point is a strong inlier.

37 The Local Outlier Factor (LOF) algorithm determines whether a data point is an outlier by primarily evaluating:

Local Outlier Factor (LOF) Medium
A. The point's isolation depth within a set of randomly constructed binary trees.
B. The sum of squared errors between the point and its assigned cluster centroid.
C. The point's local density compared to the local densities of its -nearest neighbors.
D. The point's absolute Euclidean distance to the global mean of the dataset.

38 What is the typical interpretation when a data point yields an LOF score significantly greater than 1?

Local Outlier Factor (LOF) Medium
A. The point has a lower local density than its neighbors, strongly suggesting it is an outlier.
B. The point is located in a significantly denser region than its neighbors (a strong inlier).
C. The point represents the exact centroid of a well-defined cluster.
D. The point has an identical local density to its neighbors.

39 When utilizing unsupervised anomaly detection algorithms (like Isolation Forest) for credit card fraud detection, what is a primary operational challenge?

Applications in Cybersecurity and Fraud Detection Medium
A. The algorithm typically memorizes fraudulent transactions since they dominate the dataset.
B. The models require thousands of explicitly labeled fraudulent examples to initialize the random trees.
C. Unsupervised models are strictly incapable of processing numerical transaction amounts.
D. Rare but completely legitimate customer behaviors might be flagged, leading to a high false-positive rate.

40 In detecting unauthorized access attempts on a corporate network, why might the Local Outlier Factor (LOF) method be preferred over a global distance-based statistical method?

Applications in Cybersecurity and Fraud Detection Medium
A. LOF requires strictly labeled training data, ensuring a higher precision in identifying specific known malware.
B. LOF can identify localized anomalies (e.g., weird traffic relative only to the HR department), which global methods might gloss over as normal overall traffic.
C. Global methods process data too slowly to be used in real-time cybersecurity environments.
D. LOF utilizes an isolation tree structure that naturally maps directly to standard IP address subnets.

41 Given two itemsets and with support values and , what is the maximum theoretically possible value of , and what does it imply about the itemsets?

Lift Hard
A. 1.25; is a perfect subset of in the transaction database.
B. 2.00; and always occur together.
C. 1.25; and are perfectly independent.
D. 1.00; and are mutually exclusive.

42 Assume the confidence of the rule is and the confidence of the rule is . Which of the following represents the tightest mathematically guaranteed lower bound for the confidence of the rule ?

Confidence Hard
A.
B.
C.
D.

43 Consider two mutually exclusive itemsets and in a dataset where and . What is the conviction of the rule ?

Conviction Hard
A.
B.
C.
D.

44 During the candidate generation step () of the Apriori algorithm, let . Assuming lexicographic ordering, how many candidate 3-itemsets () are generated before the pruning step, and how many remain after the pruning step?

Apriori Algorithm Hard
A. Generated: 4, Remaining: 1
B. Generated: 3, Remaining: 1
C. Generated: 4, Remaining: 2
D. Generated: 3, Remaining: 2

45 Which of the following scenarios describes the worst-case space complexity for the FP-Tree constructed by the FP-Growth algorithm?

FP-Growth algorithm Hard
A. The dataset contains highly correlated, frequently co-occurring itemsets.
B. The dataset follows a strict power-law distribution for item frequencies.
C. Every transaction contains entirely distinct items, sharing no common prefixes.
D. Every transaction contains exactly the same items.

46 In the Local Outlier Factor (LOF) algorithm, what happens to the LOF score of a point if it is placed perfectly inside a uniform, highly dense cluster where the distance between all adjacent points is a microscopic constant ?

Local Outlier Factor (LOF) Hard
A. The LOF score approaches due to division by zero in reachability distance.
B. The LOF score approaches 0, identifying it as an extreme inlier.
C. The LOF score oscillates unpredictably depending on the value of .
D. The LOF score approaches 1, as its local reachability density matches its neighbors' densities.

47 The anomaly score in an Isolation Forest is given by . If a specific data point evaluates to a score of across a large number of trees, what is the correct interpretation regarding ?

Isolation Forest Hard
A. Point is highly anomalous, as its expected path length is half the maximum possible depth.
B. Point is isolated perfectly at the root node in half of the trees.
C. Point is definitively a normal instance, as its expected path length matches the average path length of an unsuccessful search in a BST.
D. Point is a novelty introduced during inference, completely unrepresented in the training space.

48 A data scientist is modeling network traffic to flag intrusions. The training data is known to be 'polluted' with a small fraction of unidentified malicious packets. Which algorithmic approach and paradigm is mathematically most robust for this specific training condition?

Anomaly vs. novelty detection Hard
A. Novelty Detection using a standard One-Class SVM with a hard margin.
B. Supervised Binary Classification using highly imbalanced Random Forests.
C. Anomaly Detection using an Isolation Forest or a soft-margin One-Class SVM (e.g., using a hyperparameter).
D. Novelty Detection using an Isolation Forest trained on clean baseline data.

49 Fraudsters often attempt an 'evasion attack' against LOF-based fraud detection systems by creating dense 'Sybil' clusters—a tightly knit group of fraudulent accounts that exhibit identical, highly correlated transaction behaviors. How does this attack mathematically exploit the Local Outlier Factor (LOF)?

Applications in Cybersecurity and Fraud Detection Hard
A. The attack creates an infinite loop in the LOF neighborhood search, causing a denial-of-service in the fraud detection system.
B. By increasing their collective distance from the origin, they force LOF to normalize their scores to 0.
C. The attack artificially inflates the LOF score of the honest users, causing them to be banned instead.
D. By forming a dense cluster, their -distances shrink to near zero, making their local reachability density equal to that of their neighbors, yielding an LOF .

50 In Market Basket Analysis, a retailer wants to optimize cross-selling campaigns by choosing between two rules: (Lift = 3.0, Support = 2%) and (Lift = 1.5, Support = 10%). If the sole objective is to maximize the absolute number of additional expected transactions driven by the rule (above random chance), which rule should be selected and why?

Market Basket Analysis Hard
A. Rule , because it has a higher support, meaning it covers more total transactions regardless of Lift.
B. Rule , because a higher Lift guarantees a higher conditional probability of purchase.
C. Rule , because the product of Lift and Support is higher.
D. It cannot be determined without knowing the Leverage or the absolute probabilities of individual items.

51 A dataset contains 1,000,000 transactions, out of which 990,000 are 'null transactions' that contain neither item A nor item B. If we remove all 990,000 null transactions to create a filtered dataset, which of the following metrics for the rule remains perfectly invariant?

Support Hard
A. Lift of the rule
B. Confidence of the rule
C. Support of the rule
D. Leverage of the rule

52 An Isolation Forest algorithm struggles to isolate a specific point anomaly in a dataset with 50 dimensions. Investigation reveals the anomaly is easily linearly separable but hidden within a complex linear combination of 10 heavily correlated features. Why does the standard Isolation Forest fail here?

Isolation Forest Hard
A. The sub-sampling parameter is too low to capture 50 dimensions simultaneously.
B. The expected path length diverges to infinity when features are heavily correlated.
C. Isolation Forest relies on strict axis-parallel splits, making it blind to anomalies defined solely by non-axis-aligned linear combinations.
D. Isolation Forests calculate Euclidean distances, which suffer from the curse of dimensionality.

53 The Apriori property (anti-monotonicity) states that if an itemset is frequent, all its subsets must be frequent. Suppose a researcher modifies the definition of a transaction such that it includes 'negative items' (e.g., a transaction contains if item A was deliberately not bought). Does the Apriori property still mathematically hold for mining itemsets containing both positive and negative items?

Apriori Algorithm Hard
A. No, the introduction of negative items breaks the subset probability axiom, making anti-monotonicity fail.
B. Yes, but only if the minimum support threshold is set higher than $0.5$ to account for the high frequency of negative items.
C. Yes, because a negative item can simply be treated as a unique, distinct item, and the subset probability bounds still fundamentally apply.
D. No, because is inversely proportional to , causing the support counts to oscillate.

54 During the recursive mining of the FP-Tree, the algorithm constructs 'Conditional Pattern Bases'. For a heavily skewed dataset where a single frequent item appears in 95% of all transactions, where will typically be located in the conditional pattern bases of other items?

FP-Growth algorithm Hard
A. It will appear frequently at the leaves of the conditional trees, causing high memory overhead.
B. It will not appear in any conditional pattern bases, as its frequency causes it to be pruned early.
C. It will force the algorithm to fall back to an Apriori-like candidate generation to handle the skewness.
D. It will frequently appear as a single-node path near the root of the conditional trees, leading to highly efficient compression.

55 A fraud detection system evaluates credit card transactions. Let a rule be . Given the extreme class imbalance (Fraud is of all transactions), which of the following statements about rule evaluation metrics is mathematically true?

Applications in Cybersecurity and Fraud Detection Hard
A. Conviction will approach zero, rendering it useless for asymmetric rules.
B. Leverage will be mathematically maximized because is near zero.
C. Confidence is an unbiased estimator for fraud likelihood, unaffected by class imbalance.
D. Lift will likely be extremely high even if the rule generates many false positives, suffering from the Base Rate Fallacy.

56 Let and be itemsets. If , which of the following logical equivalences is definitively true regarding the transaction database?

Support Hard
A. The dataset contains no null transactions.
B. Every transaction that contains must also contain .
C. Every transaction that contains must also contain .
D. and are identical itemsets.

57 In the context of the exact mathematical objective functions, how does a One-Class SVM (used for Novelty Detection) fundamentally differ from standard PCA-based reconstruction error (used for Anomaly Detection)?

Anomaly vs. novelty detection Hard
A. One-Class SVM maximizes the margin separating data from the origin, whereas PCA minimizes orthogonal projection loss.
B. One-Class SVM minimizes a volume enclosing the training data origin, whereas PCA minimizes orthogonal projection loss.
C. There is no difference; both project data onto a lower-dimensional hyperplane optimized for variance.
D. One-Class SVM relies on Gaussian distributions, whereas PCA is non-parametric.

58 Consider the edge case in calculating the Local Outlier Factor (LOF) where a dataset contains identical duplicate instances. If there are perfectly identical points and the neighborhood parameter is set such that , what critical computational failure occurs natively in the standard LOF definition?

Local Outlier Factor (LOF) Hard
A. The algorithm identifies all points as outliers because their LOF score becomes infinite.
B. The -distance of these identical points evaluates to zero, causing a division by zero when calculating the Local Reachability Density (lrd).
C. The points form an infinite loop during the nearest-neighbor search, halting the algorithm.
D. The Reachability Distance reduces to the Manhattan distance, ignoring local density structures.

59 Which of the following conditions proves that is mathematically symmetric (i.e., )?

Lift Hard
A. It is only true when .
B. It is always true by the definition of the formula.
C. It is only true when and are statistically independent.
D. It is only true when .

60 A supermarket analyzes baskets containing {Bread, Butter, Jam}. They observe the rule has and . However, the rule has and . According to Market Basket Analysis principles, what does this mathematically reveal about the relationship?

Market Basket Analysis Hard
A. Bread and Butter are mutually exclusive items.
B. The itemsets violate the Apriori anti-monotonicity property, indicating a calculation error.
C. The dataset suffers from the base-rate fallacy regarding the purchase of Jam.
D. Butter is an 'anti-catalyst' for buying Jam when Bread is already in the basket.
Previous MCQ
Unit 4
Next MCQ
Unit 6