They are guessing and checking thousands of numbers called nonces to see if it produces a valid block with the transaction data that will be included. There’s no way to cheat or fake this process.

The protocol is designed using probabilies to identify a target difficulty resulting in 10 minute block times.

When more hash power comes online, blocks come faster, so difficulty would go up.

When hash power goes offline, the next difficulty would go down so the lower hash rate still works out to ~10 minute blocks

It retargets every 2016 blocks