A security team is evaluating an email that was flagged as suspicious. The email is well-written, uses the recipient's name, and references a recent conference the recipient attended. Which additional cue would most strongly suggest the email was generated by an AI?

The email has a perfect grammar and a neutral, generic tone that lacks personal style.

The email was sent from a free email service.

The email contains a link to a shortened URL.

The email asks the recipient to verify their account information.

A red teamer is using an AI model to generate a phishing email for a specific target. The target is known to be skeptical of unsolicited emails and often checks the sender's address. The red teamer wants to increase the email's credibility. Which prompt strategy is most effective?

Avoid referencing any specific events to keep the email generic and less suspicious.

Use a high-urgency tone to pressure the target into acting quickly.

Include in the prompt that the email should reference a recent conversation or event that the target would know about, and use a sender address that resembles a known contact.

Use a generic sender address and a generic subject line to avoid drawing attention.

Which of the following best describes how personalization improves the effectiveness of an AI-generated phishing email?

It increases the email's spam score, causing it to bypass filters

It allows the email to bypass multi-factor authentication

It makes the email appear more relevant and trustworthy to the recipient

It ensures the email is delivered to the recipient's inbox

A red-team consultant is using a public AI chatbot to draft a phishing email for a client engagement. The consultant needs the email to appear to come from the client's IT helpdesk and to reference a specific internal portal name. Which prompt best achieves this while maintaining control over the output?

Write a phishing email from the IT helpdesk that mentions the portal 'MyHub' and asks the user to verify their password.

Write a generic phishing email that looks like it is from a helpdesk and includes a link.

Write an email from the IT helpdesk about a security update and ask the user to log in to the portal.

Write a convincing email that tricks the user into clicking a link and entering their password.

Which prompt element is most important for instructing an AI to generate a phishing email that includes a sense of urgency?

A deadline or time-sensitive consequence in the scenario

A request to use formal language throughout the email

A list of common phishing keywords to include

A specification of the recipient's email address

GIAC Offensive AI Analyst

Domain 1Objective 3

Creating Phishing Emails with AI GOAA Practice Questions (Page 3)

Part of the AI Foundations and Social Engineering domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 5–8 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

Questions 11–15

11application · medium
A security team is evaluating an email that was flagged as suspicious. The email is well-written, uses the recipient's name, and references a recent conference the recipient attended. Which additional cue would most strongly suggest the email was generated by an AI?
Select an answer first
12expert · hard
A red teamer is using an AI model to generate a phishing email for a specific target. The target is known to be skeptical of unsolicited emails and often checks the sender's address. The red teamer wants to increase the email's credibility. Which prompt strategy is most effective?
Select an answer first
13foundation · easy
Which of the following best describes how personalization improves the effectiveness of an AI-generated phishing email?
Select an answer first
14application · medium
A red-team consultant is using a public AI chatbot to draft a phishing email for a client engagement. The consultant needs the email to appear to come from the client's IT helpdesk and to reference a specific internal portal name. Which prompt best achieves this while maintaining control over the output?
Select an answer first
15foundation · easy
Which prompt element is most important for instructing an AI to generate a phishing email that includes a sense of urgency?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GOAA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GOAA” is a trademark of its owner, used for identification only.