Skip to content
AI Security

Interview question · AI Governance, Risk & Compliance

How do C2PA Content Credentials and AI watermarks differ, what can each prove about an image, and how would you use them in a product?

Signed provenance and invisible watermarks are often lumped together as 'AI detection'. They prove different things and fail in different ways, which is the whole answer.

mediumNewPreparation tags: Google, Microsoft, OpenAIUpdated Nov 2026

Signed provenance and invisible watermarks are often lumped together as 'AI detection'. They prove different things and fail in different ways, which is the whole answer.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 4 follow-ups like an interviewer would

A news site receives a dramatic photo from a reader. It carries a valid C2PA manifest saying it was captured on a phone model and not edited. Another outlet says the same scene was staged.

  1. What does the valid manifest establish?
  2. What else would you check?
  3. How should the site display provenance to readers?
  4. How do you summarise C2PA versus watermarks?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackWhich US AI laws matter to a security team in late 2026, and how would you build one programme that covers the main state laws?Next in this trackWhat do the UK AI cyber security code, ETSI's AI baseline standard and NIST's draft Cyber AI Profile ask for, and how would you use them?Next in this trackA security report is fully green but excludes an acquired cloud account. How would you correct it?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.