A journalist receives an anonymous image of a politician that appears to show them in a compromising situation. Before publishing, the journalist wants to assess the image's authenticity. Which approach is most appropriate?

Ask the politician's office to confirm the image's authenticity before doing any analysis.

Publish the image immediately because the source claims it is authentic, and rely on the public to judge.

Enhance the image resolution and contrast to see if it looks more realistic.

Use a GAN-based detector to look for generator artifacts and examine the image's metadata and compression history.

Which of the following is a common visual artifact that forensic analysts look for when detecting a deepfake video?

Perfectly consistent frame rates

Inconsistent lighting and shadows

A forensic analyst is examining a facial image that is suspected of being generated by a GAN. Which observation would most strongly support this conclusion?

The image's metadata indicates it was taken with a smartphone.

The image has consistent artifacts in the frequency domain, such as periodic patterns in the high-frequency components.

The image has a high resolution and sharp edges.

The image shows a person with an unusual hairstyle.

A security researcher is analyzing a video that is suspected to be a deepfake. The video shows a person's face being swapped onto another body. Which artifact is most indicative of this type of manipulation?

The video's frame rate is 30 frames per second.

The video has a watermark from a social media platform.

Inconsistent skin tones between the face and the neck or hands.

A research team is developing a deepfake detection system and wants to evaluate it against a variety of manipulation techniques. Which dataset design would provide the most comprehensive evaluation?

Use only the latest state-of-the-art deepfake generation models.

Include only deepfakes that are visually obvious to human observers.

Include both audio and video deepfakes, with multiple generation methods and real-world post-processing.

Use only high-quality, uncompressed media to ensure clean labels.

GIAC Offensive AI Analyst

Domain 3Objective 3

Audio, Image, and Video Deepfakes GOAA Practice Questions (Page 4)

Part of the AI-Enhanced Malware and Deepfakes domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 16–20

16application · medium
A journalist receives an anonymous image of a politician that appears to show them in a compromising situation. Before publishing, the journalist wants to assess the image's authenticity. Which approach is most appropriate?
Select an answer first
17foundation · easy
Which of the following is a common visual artifact that forensic analysts look for when detecting a deepfake video?
Select an answer first
18application · medium
A forensic analyst is examining a facial image that is suspected of being generated by a GAN. Which observation would most strongly support this conclusion?
Select an answer first
19application · medium
A security researcher is analyzing a video that is suspected to be a deepfake. The video shows a person's face being swapped onto another body. Which artifact is most indicative of this type of manipulation?
Select an answer first
20expert · hard
A research team is developing a deepfake detection system and wants to evaluate it against a variety of manipulation techniques. Which dataset design would provide the most comprehensive evaluation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.