Procurement has only a bidder email address on a bid packet and no website or photograph. Which tool class should the analyst open first?
Select an answer to reveal the explanation.
Short Explanation
Start with the clue you actually have. An email is a mailbox-shaped key, so you open email, exposure-check, and people drawers—not a Wi-Fi map or a photo tool with no photo. The identifier picks the family.
Full Explanation
PORP-style tool choice follows the starting identifier. When procurement has only a bidder email address and no website or photograph, the analyst should open email, breach-exposure, and people-search classes keyed to that address because the identifier dictates the tool family. Public results from those classes create sourced pivots for vendor due diligence without pretending every problem is a wireless or image job.
A wireless observation map of the city fleet garage assumes an SSID clue the packet does not contain. A reverse-image appliance with no photograph attached cannot visualize an email. A dark-web market scraper listed as a leaf on a public framework tree sits outside this course's Fundamentals families and is the wrong first move for a bid-email lead.
Exam caveat: breach-exposure lookups report what public corpora show about an address; they are not proof of current compromise of the vendor's live systems. Cite tool, time, and corpus limits carefully in the municipal packet.
Operational check: query email, people, and exposure classes with the exact bid email; record URLs and timestamps; summarize only verified public hits; and defer wireless or image tools until those identifier types appear in evidence.