IR receives a video ‘mayor directive’ to disable MFA citywide and compares it to known authentic channels before acting. What operational skill does this primarily demonstrate?

Distinguishing deepfake-enhanced social engineering from verified official instructions means comparing a startling video ‘mayor directive’—such as an order to disable MFA citywide—against known authentic channels before taking high-impact action. That operational skill prevents adversaries from using synthetic media to coerce dangerous configuration changes while still allowing genuine emergency communications that arrive through approved paths. Analyzing video compression artifacts to confirm authorized recording devices is a forensic media-analysis technique and does not address the core task of verifying a video mayoral directive against authentic channels before acting. Matching spoken directives against enrolled executive voiceprint reference templates focuses on biometric voice comparison rather than verifying through known authentic channels and can be defeated by cloned audio, so it does not demonstrate the immediate verify-before-act skill needed when faced with a suspicious mayoral video. Preserving video file metadata under documented chain-of-custody evidence procedures is an evidence-handling step, not the primary operational skill of distinguishing a deepfake directive from verified official instructions before acting. Exam caveat: verify-before-act against deepfake executive media is the skill; analyzing compression artifacts, matching voiceprint templates, and chain-of-custody evidence handling are not the primary skill being tested. Operational check: maintain a short list of authentic mayor/CIO channels and call-back procedures, require dual approval for citywide MFA or identity changes, preserve suspect media for analysis, and train IR and helpdesk that urgency plus unverifiable video is a hold-and-confirm event.