A media verification team is analyzing a video that shows a politician giving a speech. The team notices that the politician's mouth movements are slightly out of sync with the audio track. Which deepfake technique is most likely responsible?

Full-body synthesis, where the entire person is generated.

Face swapping, where the politician's face is replaced with another person's.

Lip-syncing, where the mouth is re-rendered to match a different audio track.

Attribute editing, such as changing the politician's eye color.

A social media platform is facing criticism for hosting deepfake videos that spread misinformation. The platform wants to implement a policy that balances user privacy and content moderation. Which approach is most aligned with ethical and legal best practices?

Automatically remove all content that is flagged as synthetic by an AI detector, without human review.

Allow all content unless it causes immediate physical harm, and rely on user reports to take action.

Require users to label any synthetic or manipulated media that could mislead viewers, and remove content that is clearly harmful or illegal.

Ban all deepfake technology and require users to verify their identity with government ID before posting any video.

A red team is tasked with testing a company's voice biometric authentication system. They have a large dataset of the CEO's public speeches. The team needs to create a voice clone that can bypass the system, but they have limited computational resources and time. Which approach would be most efficient?

Train a voice conversion model from scratch on the entire dataset.

Use a generic TTS voice that sounds similar to the CEO.

Use a pre-trained text-to-speech model and fine-tune it on a small set of the CEO's high-quality recordings.

Record the CEO's voice from public speeches and replay it directly.

A threat actor has created a video of a company executive saying something they never said, using a face-swap technique. The video is being circulated internally. Which detection method would be most effective in identifying this specific type of manipulation?

Check the video's file size and resolution to see if it matches typical camera output.

Compare the video's audio track to a known sample of the executive's voice using a voice recognition system.

Look for watermarks or logos from known video editing software.

Analyze the video for temporal inconsistencies such as blinking patterns, lip-sync errors, and frame-to-frame flickering.

A forensic analyst is examining an audio recording that is suspected to be a deepfake. The analyst notices that the audio has no background noise and the voice has an unnatural rhythm. Which detection technique is most appropriate?

Check the audio's file format to see if it is a common format like MP3.

Analyze the audio's spectrogram for missing high-frequency components and unnatural pauses.

Listen to the audio with high-quality headphones to detect any subtle distortions.

Compare the audio's duration to the transcript to see if it matches.

GIAC Offensive AI Analyst

Domain 3Objective 3

Audio, Image, and Video Deepfakes GOAA Practice Questions (Page 1)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 1–5

1application · medium
A media verification team is analyzing a video that shows a politician giving a speech. The team notices that the politician's mouth movements are slightly out of sync with the audio track. Which deepfake technique is most likely responsible?
Select an answer first
2application · medium
A social media platform is facing criticism for hosting deepfake videos that spread misinformation. The platform wants to implement a policy that balances user privacy and content moderation. Which approach is most aligned with ethical and legal best practices?
Select an answer first
3expert · hard
A red team is tasked with testing a company's voice biometric authentication system. They have a large dataset of the CEO's public speeches. The team needs to create a voice clone that can bypass the system, but they have limited computational resources and time. Which approach would be most efficient?
Select an answer first
4application · medium
A threat actor has created a video of a company executive saying something they never said, using a face-swap technique. The video is being circulated internally. Which detection method would be most effective in identifying this specific type of manipulation?
Select an answer first
5application · medium
A forensic analyst is examining an audio recording that is suspected to be a deepfake. The analyst notices that the audio has no background noise and the voice has an unnatural rhythm. Which detection technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.