A municipal broadband team wants OSINT on a pole-attachment contractor and also wants the analyst to scan the contractor's exposed remote-desktop service. What should the analyst do?
Select an answer to reveal the explanation.
Short Explanation
Looking up a shop in the phone book is not kicking the back door to see if it is unlocked. Public websites, filings, and news are the OSINT lane. Scanning or probing the contractor's remote-desktop service is pentest work, not Fundamentals research.
Full Explanation
PORP-aligned municipal research on a pole-attachment contractor stays with passive public sources—filings, news, maps, published documents—and refuses active scanning or exploitation of the contractor's exposed remote-desktop service. An open port is not automatically fair-game OSINT to probe; scanning it first because it is reachable turns the task into active testing, not open-source collection. Attempting logins against the remote-desktop service and treating passwords as OSINT artifacts is unauthorized access. Standing up a rogue access point near the contractor yard to collect traffic is offensive interception, far outside civic OSINT scope. Exam caveat: vulnerability management or authorized security testing may exist under separate charters, but those activities must not be smuggled into an OSINT due-diligence pack. Operational check: if the next step requires sending probes, guessing credentials, or inserting network equipment, stop, document the public-source limit, and escalate rather than continuing under an OSINT label. Keep the civic purpose, method limits, and exhibit labels aligned so reviewers can see what was public-source work versus other authorities. Document residual uncertainty explicitly rather than implying completeness.