GCIH Malware and AI-Assisted Investigations Practice Question
When investigating an AI-generated spear-phishing campaign, what is the most effective indicator to look for that suggests the content was created by a Large Language Model (LLM)?
⚠ Common exam trap
Candidates often look for 'spelling errors' or 'bad grammar,' forgetting that modern LLMs are highly proficient at generating grammatically perfect text that lacks specific, localized organizational context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Consistent, overly formal tone that lacks specific organizational context.
LLMs often produce text that is grammatically perfect but lacks the specific, idiosyncratic context or 'human touch' of targeted communication. Identifying these characteristics requires comparing the suspect emails against known communication baselines of the purported sender. Understanding these patterns is crucial because AI can now produce highly convincing phishing lures at scale, requiring responders to look past the superficial professionalism to find the lack of contextual depth or intent alignment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Presence of multiple spelling and grammatical errors.
Why it's wrong here
Spear-phishing lures generated by LLMs are typically grammatically flawless and free of spelling errors. While traditional phishing emails are often riddled with errors, AI-generated lures are specifically designed to appear professional. Expecting errors as an indicator of automated content is fundamentally incorrect in the era of sophisticated generative AI phishing.
- ✓
Consistent, overly formal tone that lacks specific organizational context.
Why this is correct
AI models tend to default to a polite, formal, and generic tone when instructed to write persuasive emails. They often lack the 'tribal knowledge' or specific cultural context of the target organization. This generic nature is a strong indicator of AI generation, as human-written phishing often contains specific internal references or unique colloquialisms.
- ✗
Inclusion of malicious code within the email header metadata.
Why it's wrong here
Malicious code is typically delivered via attachments or embedded links, not within email headers. Furthermore, the generation of phishing text by an LLM is independent of the delivery mechanism's technical configuration. Focusing on header metadata distracts from the core task of analyzing the content of the email to identify signs of automation.
- ✗
The email is sent from a known, compromised account.
Why it's wrong here
The source of the email—even if it is a compromised account—does not indicate how the content of the message was generated. A human attacker could have written the email, or they could have used an AI model. The sender's identity is a separate issue from whether the content itself is AI-generated.
Visual reference
About these practice questions
This GCIH question is part of Courseiva's 322-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.