A digital forensics team is investigating a suspected deepfake image that was shared on a social media platform. The image has been compressed and resized multiple times. Which detection method is most likely to remain effective?

Compare the image to the original source using reverse image search.

Use a deep learning detector trained only on high-resolution images.

Analyze the image for GAN-specific frequency artifacts that persist after compression.

Check the image's EXIF metadata for editing software traces.

A startup is developing a deepfake detection product. They need to choose a generation technique to create training data for their model. Which technique would produce the most diverse and realistic training data for image deepfakes?

Use a face-swapping tool on a single video to create multiple frames.

Use a Generative Adversarial Network (GAN) to synthesize a wide variety of fake faces with different poses, expressions, and lighting conditions.

Use a simple autoencoder to reconstruct images from a small dataset of real faces.

Use a text-to-speech system to generate audio and then convert it to images.

A security operations center receives a voicemail from the CEO's number demanding an urgent wire transfer. The audio sounds like the CEO, but the SOC manager suspects a deepfake. Which combination of actions would best confirm the suspicion while preserving evidence for potential legal action?

Run the audio through a spectrogram analysis to look for unnatural frequency gaps, and preserve the original file with cryptographic hash and metadata.

Immediately call the CEO's personal cell phone to verify the request, then delete the voicemail to avoid further risk.

Check the voicemail's metadata for the originating phone number and assume it is legitimate if the number matches the CEO's known number.

Use a commercial voice-cloning tool to see if the audio can be recreated, then compare the two files by ear.

A social media company is developing an automated system to detect deepfake videos. They have a large dataset of real videos and a smaller dataset of deepfakes. They want to maximize detection while minimizing false positives. Which approach is most effective?

Train a supervised classifier on the labeled dataset and tune the threshold to balance precision and recall.

Use an unsupervised anomaly detection model that flags videos that deviate from the norm.

Rely on user reports to flag potential deepfakes and then manually review them.

Use a simple rule-based system that checks for specific artifacts like blinking rate.

GIAC Offensive AI Analyst

Domain 3Objective 3

Audio, Image, and Video Deepfakes GOAA Practice Questions (Page 3)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 11–15

11expert · hard
A digital forensics team is investigating a suspected deepfake image that was shared on a social media platform. The image has been compressed and resized multiple times. Which detection method is most likely to remain effective?
Select an answer first
12application · medium
A startup is developing a deepfake detection product. They need to choose a generation technique to create training data for their model. Which technique would produce the most diverse and realistic training data for image deepfakes?
Select an answer first
13application · medium
A security operations center receives a voicemail from the CEO's number demanding an urgent wire transfer. The audio sounds like the CEO, but the SOC manager suspects a deepfake. Which combination of actions would best confirm the suspicion while preserving evidence for potential legal action?
Select an answer first
14foundation · easy
Which video deepfake technique involves replacing the face of a person in a video with the face of another person while preserving the original facial expressions and movements?
Select an answer first
15expert · hard
A social media company is developing an automated system to detect deepfake videos. They have a large dataset of real videos and a smaller dataset of deepfakes. They want to maximize detection while minimizing false positives. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.