A social media platform wants to automatically flag potential deepfake videos uploaded by users. Which detection strategy would be most robust against common post-processing like compression and resizing?

Use a simple pixel-difference comparison between consecutive frames.

Train a classifier on both pristine and manipulated videos using multiple compression levels and resolutions.

Check for the presence of a digital watermark in every video.

Rely solely on a single deep learning model trained on high-resolution, uncompressed videos.

A media forensics lab is tasked with authenticating a video that may be a deepfake. The video is of a public figure speaking at an event. The lab has limited computing resources and must provide a preliminary assessment within hours. Which approach is most appropriate?

Train a custom deep learning model on the spot using the video and a few other samples.

Send the video to a cloud-based deepfake detection API and wait for the results.

Use a blockchain-based verification service to check the video's provenance.

Run a lightweight artifact analysis for common deepfake traces, such as inconsistent facial landmarks and unnatural eye blinking, and compare with known authentic footage.

A security team is evaluating a video that allegedly shows a company executive making a confidential statement. The video has inconsistent lighting on the face and occasional lip-sync errors. Which type of deepfake technique was most likely used?

Attribute editing, such as changing the executive's hair color.

Face swapping, where the executive's face is mapped onto another person's body.

Full-body synthesis, where an entirely synthetic person is generated.

Text-to-speech conversion, where the audio is generated from text.

A cybersecurity analyst is investigating a vishing attack where the attacker spoofed a senior executive's voice. The analyst has a short recording of the fake call and a longer sample of the executive's genuine voice. Which technique would be most effective for confirming the voice was cloned?

Analyze the background noise in both recordings for matching ambient sounds.

Compare the prosodic features and pitch contours of both samples using a voice conversion analysis tool.

Use a speaker verification system to see if the two samples match exactly.

Check if the fake recording has a higher bitrate than the genuine sample.

A company's CEO has been targeted by a voice-cloning attack. The attacker used a short audio clip of the CEO's speech to clone their voice and make fraudulent phone calls. Which mitigation is most effective?

Remove all public audio of the CEO from the internet.

Advise the CEO to speak in a monotone voice to make cloning harder.

Implement a verbal code word that is not publicly known for sensitive transactions.

Use a voice biometric system that relies solely on the CEO's voiceprint.

GIAC Offensive AI Analyst

Domain 3Objective 3

Audio, Image, and Video Deepfakes GOAA Practice Questions (Page 2)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 6–10

6application · medium
A social media platform wants to automatically flag potential deepfake videos uploaded by users. Which detection strategy would be most robust against common post-processing like compression and resizing?
Select an answer first
7expert · hard
A media forensics lab is tasked with authenticating a video that may be a deepfake. The video is of a public figure speaking at an event. The lab has limited computing resources and must provide a preliminary assessment within hours. Which approach is most appropriate?
Select an answer first
8application · medium
A security team is evaluating a video that allegedly shows a company executive making a confidential statement. The video has inconsistent lighting on the face and occasional lip-sync errors. Which type of deepfake technique was most likely used?
Select an answer first
9application · medium
A cybersecurity analyst is investigating a vishing attack where the attacker spoofed a senior executive's voice. The analyst has a short recording of the fake call and a longer sample of the executive's genuine voice. Which technique would be most effective for confirming the voice was cloned?
Select an answer first
10application · medium
A company's CEO has been targeted by a voice-cloning attack. The attacker used a short audio clip of the CEO's speech to clone their voice and make fraudulent phone calls. Which mitigation is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.