The public information office reports a fake social account impersonating the fire department. Which tool class should the analyst open first?
Select an answer to reveal the explanation.
Short Explanation
A fake fire-department page is a social-media artifact, so you collect the public profile first. Corporate filings and wireless attacks answer different questions. Screenshot the account, then pivot.
Full Explanation
When the question is an impersonating civic social account, the first tool class is social collection: public profile capture, posts, media, and remaining platform artifacts. For a fake account impersonating the fire department, that public social surface is the evidence PIO and fire leadership need first, before any later business-filing pivot if a company name appears.
Dumping secretary-of-state filings for every LLC in the county before looking at the profile wastes time and ignores the artifact that prompted the ticket. Capturing wireless handshakes against station guest Wi-Fi to identify the impersonator is offensive wireless work outside PORP. A password-recovery job against a guessed department mailbox is credential attack, not OSINT.
Exam caveat: social collection documents what is public on the impostor account; it does not by itself identify the human operator. Keep operator attribution separate unless additional sourced pivots appear.
Operational check: capture the public profile URL, posts, display name, and timestamps; archive or screenshot; notify PIO/fire; and defer filings or other pivots until identifiers from the profile justify them—without Wi-Fi or mailbox attacks.