The public information office reports a fake social account impersonating the fire department. Which tool class should the analyst open first?
Select an answer to reveal the explanation.
Short Explanation
A fake fire-department page is a social-media artifact, so you collect the public profile first. Corporate filings and wireless attacks answer different questions. Screenshot the account, then pivot.
Full Explanation
When the question is an impersonating civic social account, the first tool class is social collection: public profile capture, posts, media, and platform metadata that remain visible. Business-filing dumps may become a later pivot if a company name appears. Wireless attacks and mailbox attacks are outside PORP. Evidence is the public social surface, not an exploit.