Question

During a year-long cybersecurity breach, about 1,000 remote employees at Firm Z reported their accounts had been compromised. Around the same number of on-site employees also reported compromised accounts. Based on these figures, it can be hypothesized that working remotely was no more vulnerable to security breaches than working on-site.
Which of the following, if it could be carried out, would be most useful in an evaluation of the above hypothesis?

• A. Determining whether remote employees use more personal devices than on-site employees when accessing company systems
• B. Comparing the proportion of compromised accounts among remote employees to the proportion among on-site employees
• C. Investigating whether some of the compromised accounts involved employees who switched between remote and on-site work during the breach
• D. Analyzing the types of data accessed by compromised remote accounts compared to those accessed by compromised on-site accounts
• E. Determining whether other companies experienced more breaches among remote employees than among on-site employees during the same period

Hint:

When an argument compares the risk or likelihood of an event between two groups based on absolute numbers, the most crucial information needed for evaluation is almost always the total size of each group. This allows for the calculation of rates or proportions, which are the correct measures for comparing risk.

Answer 1

The Correct Option is B

Step 1: Understanding the Concept
This is a Critical Reasoning question asking how to best evaluate a hypothesis. The hypothesis compares the "vulnerability" of two groups. The evidence provided uses absolute numbers. The core of evaluating such a claim lies in determining if the comparison is fair.
Step 2: Detailed Explanation


Hypothesis: Remote work is not more vulnerable than on-site work.
Evidence: Number of remote compromises (\(\approx 1,000\)) \(\approx\) Number of on-site compromises (\(\approx 1,000\)).
The Flaw in the Evidence: Comparing the absolute number of incidents between two groups is misleading if the groups are of different sizes. To compare "vulnerability" or "risk," one must compare the rates or proportions of the incidents. For example, if there were only 1,100 remote employees in total, a compromise rate of 1,000/1,100 (\(\approx 91%\)) would be extremely high. If there were 20,000 on-site employees, a rate of 1,000/20,000 (5%) would be much lower. The absolute numbers are the same, but the vulnerability is drastically different.
Step 3: Final Answer
To properly evaluate the hypothesis, we need to know the total number of employees in each group (remote and on-site) to calculate the proportion of compromised accounts for each. Option (B) directly addresses this central need. By comparing the proportions (or percentages), we can make a valid assessment of which group was more vulnerable. The other options might be interesting but do not address the fundamental statistical flaw in the original evidence.