A city SOC triage checklist for suspected deepfake tickets asks analysts to label the artifact before escalating. Which classification step is most appropriate at intake?
Select an answer to reveal the explanation.
Short Explanation
Start by identifying what kind of artifact you have—audio, a still image, or video—so you can send it to the right playbook. This modality check helps you avoid routing unlike cases into the same queue.
Full Explanation
At intake for a suspected deepfake ticket, classify the artifact as audio-only, a still image, or full video so you can route it to the correct playbook and specialists. Modality guides verification steps, public-communications handling, forensic tooling, and escalation paths; identifying it first helps keep unlike cases out of the same queue and improves time to useful action. Rating priority from reported impact before identifying the artifact type may help assess urgency, but it does not provide the classification needed for routing. Deleting the artifact immediately destroys evidence and prevents classification. Labeling every deepfake ticket as ransomware conflates unrelated threat classes and pollutes metrics. Exam caveat: when a question asks for the classification step at intake, identify modality and route the playbook rather than prioritizing by impact or applying an unrelated category. Practical check: preserve the artifact, tag it as audio, image, or video when opening the ticket, select the matching playbook, and notify public affairs when a civic official is impersonated.