PORP practice questions
TCM Security · PORP · 300 questions
Original practice questions for the TCM Security Practical OSINT Researcher Professional (PORP) exam, covering OSINT foundations, search and image intelligence, social media analysis, website and wireless reconnaissance, tools and automation, and identity pivots.
This course contains the use of artificial intelligence.
About the PORP exam
The real exam is hands-on rather than multiple choice. The questions here drill the underlying knowledge; they do not reproduce the exam's format.
- Exam fee
- $399 USD
- Time allowed
- 3 days
- Passing score
- 80 of 100 points
- Format
- Hands-on practical exam, no multiple choice: 72 hours to solve real-world OSINT challenges and submit a professionally written report
Exam details published by the vendor, checked 25 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
OSINT Foundations and OPSEC · 50 questions
- A city clerk's public-records unit is asked to pull everything on a paving vendor, including a non-public utility billing screen the clerk can open in the city's internal CIS. Which approach correctly treats the work as OSINT?
- A transit authority fraud analyst finds a contractor spreadsheet on a public paste site that appears to have been leaked without authorization. How should the analyst treat that file when deciding what counts as OSINT?
- Parks and recreation leadership calls every web search intelligence and wants a folder of unsourced links dropped into the weekly briefing. What should the analyst deliver instead?
- A county assessor asks an analyst to skip documenting sources because everyone already knows the GIS portal. What should the analyst do?
- Emergency management wants social-media rumors about a washout treated as confirmed road closures on the public map. What should the OSINT analyst do first?
- A housing-authority investigator is told that OSINT on a disputed application means hacking the applicant portal to read records that are not public. What is the correct response?
- Procurement wants a due-diligence pack on a new snow-plow vendor built only from the vendor's marketing site. What should the OSINT analyst do?
- A library consortium privacy officer asks whether reviewing a contract cataloger's public LinkedIn profile for a vendor-conflict check is OSINT or spying. What is the correct judgment?
- Code enforcement wants the analyst to friend a property owner under a fake identity so private photo albums become visible. What should the analyst do?
- The city attorney asks whether FOIA responses the city itself already issued can be reused as OSINT in a vendor review. How should the analyst treat those records?
- A port-authority analyst starts collecting web pages before anyone writes the question the report must answer. What should happen first?
- Public-health permit staff want sit-down interviews of restaurant owners counted as OSINT for a permit-review packet. How should the analyst classify that work?
- A 311 manager wants the analyst to use the city's sealed juvenile-case files, arguing that staff already have access, while building an OSINT memo on a contractor. What is the correct scope decision?
- Economic-development staff treat a paid data-broker dump as open source because the city purchased it. What distinction should the analyst make?
- The elections office wants campaign-finance PDFs from the state disclosure site used in a vendor conflict check. How should those files be treated?
- Stormwater staff ask whether satellite imagery on a public map layer is OSINT or classified ISR. What is the correct classification?
- A municipal broadband team wants OSINT on a pole-attachment contractor and also wants the analyst to scan the contractor's exposed remote-desktop service. What should the analyst do?
- A city GIS analyst pastes findings into a personal chat app with no URLs or timestamps. What note practice should replace that habit?
- Permitting staff screenshot a vendor site but crop out the address bar. Why is that a problem for OSINT evidence?
- Fleet management asks the analyst to keep findings in memory until Friday instead of writing notes during collection. What should the analyst do?
- A parks investigator pastes an entire public Facebook thread into Word without marking which comment is the actual finding. What should the notes do instead?
- The water department's analyst overwrites yesterday's notes in the same file so earlier versions vanish. What practice should replace that habit?
- A convention-bureau researcher uses a shared staff login for all collection so nobody can tell who captured what. What should the research log do?
- Animal-control staff save only the thumbnail of a lost-pet flyer and later cannot read the phone number. What capture standard should they use?
- Public works wants last year's dead links left in a live report with no retrieved-on date. Why should the analyst record retrieval dates?
- A county recorder OSINT analyst stores investigation notes, screenshots, and research logins in the same browser profile used for personal online banking. What should the analyst change first?
- A city open-data team bookmarks forty vendor-research tabs and treats that folder as the case file. What should the OSINT analyst use instead?
- A municipal court clerk doing public-docket OSINT finds a scanned exhibit that includes full Social Security numbers and pastes those numbers into a team Slack channel used for research notes. What should the clerk do instead?
- Recycling-program staff screenshot a public map of alleged illegal dumping but do not record coordinates, layer names, or the map URL. What should their notes include so another analyst can re-find the place?
- A sister-city program intern translates a foreign vendor's public webpage in the browser and saves only the English translation in the case file. What should the intern keep as well?
- A parking-authority analyst runs OSINT from a personal phone that is still logged into private social apps. What OPSEC problem does that create?
- Building-inspection leadership wants analysts to accept every cookie banner on target vendor sites while signed into the city's main domain account. What should the analyst do instead?
- A fire-department PIO intern googles a suspicious donation page from the station Wi-Fi without a research profile or other network-path control. What OPSEC issue should the intern recognize?
- The historic-preservation office stores sock-puppet passwords in the same shared spreadsheet as the public website CMS credentials. What credential-hygiene change is required?
- A city communications analyst creates a research sock-puppet account using their real municipal email address. Why is that a failure?
- Code enforcement wants one long-lived uber research account reused on every platform and every case for years. What reuse risk should the analyst flag?
- A transit analyst logs into a sock-puppet account from the same browser profile that holds personal shopping logins. What contamination problem does that create?
- Parks staff name a research account DumpingCaseWestPark after the exact investigation. What naming approach should they use instead?
- The library IT lab virtual machine used for OSINT is never snapshotted or reset, and malware from a sketchy event-flyer site persists into the next case. What lab-hygiene practice is missing?
- A procurement analyst uses their real face as the sock-puppet avatar so the account looks trustworthy. What should the analyst do instead?
- Public-works researchers argue that sock-puppet accounts are always illegal, so they plan to log in as a named city official to reach private vendor portals instead. What distinction should they apply?
- A marina office wants the OSINT analyst to friend boat owners and chat them for slip numbers. What collection method stays in PORP scope?
- County GIS builds the OSINT lab on the same laptop that runs the production parcel-edit database. What isolation requirement should the candidate insist on?
- A 311 research account follows only the five people named in a complaint, making the persona obviously a watcher. What behavior-hygiene change is needed?
- The city manager tells an analyst to disable all note-taking so a Discord OSINT drill goes faster. What should the analyst defend?
- Occupancy-licensing staff install random OSINT toolbars from a blog into the city's main Chrome browser. What lab-software hygiene should they follow instead?
- A grants-office researcher reuses the city's email password on a sock-puppet account. What uniqueness rule should they follow?
- Bike-share investigators want to collect OSINT from a cafe laptop with full-disk encryption turned off because OSINT is just websites. What lab protection should they apply?
- A tourism-board intern live-tweets each step of an active OSINT investigation from a personal handle. What OPSEC rule does that break?
- The solid-waste director asks whether a well-run sock puppet plus a thorough notebook can replace a written OSINT report. What should the analyst answer?
Search, Image, and Location · 50 questions
- A procurement analyst needs PDF copies of a paving vendor's old city contracts that still live on the finance site. Staff have been scrolling HTML pages one by one. Which search approach should the analyst use first?
- The city clerk wants mentions of a sidewalk contractor limited to the city's own website, not random blogs. Which search technique should the analyst apply?
- Parks staff search a mural artist's slogan and keep getting song lyrics instead of the commission. Why should they switch to a quoted-phrase search?
- A 311 team searching for dumping also wants illegal fill, but not the city's recycling FAQ. Which operator combination should they apply?
- Transit marketing rebranded a bus-lane project, but old PDFs still use the prior name. What should the analyst do when searching for public records?
- Housing authority staff conclude a property manager has no public footprint after glancing at the first page of generic results. What should the OSINT analyst do before accepting that claim?
- The county assessor wants spreadsheets of comparable sales that were posted as attachments on the assessor site. Which search approach best finds those civic attachments?
- A stormwater report vanished from the live public-works site after a CMS redesign and now returns 404. What should the analyst try next?
- Economic development needs only the last month of public results about a factory-relocation rumor. Why apply a time-bounded search?
- Public works needs hits on a unique invoice number that looks like a serial. How should the analyst query it?
- Library IT wants to know whether an abandoned departmental microsite still exposes public directory listings of PDFs. Which fundamentals-level OSINT step is appropriate?
- The port authority searches a vessel name that is also a common English word and gets thousands of unrelated hits. What should the analyst add?
- Elections staff search a candidate's name and keep hitting a different person in another county. How should they disambiguate?
- A fire-prevention educator needs slide decks the department posted years ago as PowerPoint files. Why should the search not be limited to PDF?
- Code enforcement googles a complaint address in natural language and misses the GIS parcel page that uses a formatted APN. What should the analyst search?
- The open-data officer asks why two search engines return different hits for the same site-restricted query. How should the analyst explain it?
- A convention-bureau analyst treats search-autocomplete suggestions as confirmed downtown venue names. What is the correct handling?
- Parks posts a new-playground photo that a resident claims is actually another city's park. What should the analyst do before reprinting the claim?
- A vendor's 'our crew on your street' photo reverse-matches a stock-photo library. How should procurement treat that result?
- 311 receives a dumped-mattress photo. Reverse image search shows the same photo on a marketplace listing from last year. What should the analyst conclude?
- Historic preservation has a facade photo with no EXIF because it came from Instagram. What should the analyst assume?
- Building inspection receives an original JPEG from a resident's camera that still has GPS EXIF. How should they use those coordinates?
- A tourism photo's EXIF timestamp is midnight UTC while the caption says sunset concert. How should the analyst treat the camera clock?
- Fleet staff reverse-search a damaged-city-truck photo and get many near-duplicates from news sites. What should they look for to support a timeline?
- Public-health permit photos of a kitchen were clearly screenshots, with status bar and app chrome visible. What does the file's EXIF describe?
- A housing-authority flyer uses a tightly cropped photo of a building facade. Public copies of the same shot, uncropped, show a different building in the background. What is the better reverse-image input?
- The marina office recovers a boat photo whose EXIF lists camera make and model but no GPS. How should the analyst treat those device tags?
- Sister-city staff reverse-search a logo that is a variant of the municipal seal and get hits on letterhead, proclamations, and other official stationery. What does that result mean?
- Snow-operations posts a plow photo whose EXIF includes an “edited with” software tag. What is the professional next step?
- Animal control reverse-searches a “found dog” photo used in a local appeal and finds the same image on a rescue listing in another state. What should the analyst conclude?
- Open-data staff strip EXIF from published street photos as a privacy policy. An analyst later cannot recover GPS from the portal copy. What should the analyst recognize?
- A resident sends a messaging-app-compressed photo of alleged curb damage. EXIF is gone and reverse-image results are thin. What should the analyst do?
- The convention bureau’s hero image reverse-matches a photographer’s portfolio labeled as another city. What should staff do before reprinting it?
- Code enforcement wants to run a blurry license plate through a generative upscaler and treat the invented characters as EXIF-quality fact. What should the analyst do?
- A dumped-debris photo shows a unique water tower painted with a high-school mascot. How should the analyst geolocate the dump site?
- Transit receives a bus-shelter vandalism photo showing a route number and a unique mural. What is the strongest public location path?
- Parks needs a lakeside-dock photo geolocated. Vegetation and a dam shape appear to match only one reservoir on the city’s map. What method should the analyst use?
- A 311 photo shows long, east-facing shadows while the complainant says it was “noon at City Hall.” How should the analyst use that lighting?
- Street-sign text in a photo names a block that city GIS shows as one-way opposite to the claimed direction of travel. What should the analyst do?
- The municipal airport authority is shown a photo claimed to be “our terminal,” but the jet-bridge paint scheme belongs to another region. What is the right location path?
- Public-works hydrant colors follow a known city code. A photo’s hydrant-cap color does not match that block’s GIS record. How should the analyst treat the mismatch?
- A photo labeled “downtown” shows shop-sign language that does not appear in the city’s business-license records. What should the analyst infer?
- Emergency management wants to geolocate a flooded underpass from a dashboard-camera still. A mile marker and a unique overpass mural are visible. What should the analyst do first?
- Library events staff try to geolocate a stolen-banner photo using Street View-class imagery that is three years old. A new building in the photo is missing on that layer. What should they remember?
- Zoning staff are shown a “vacant lot” photo in which power-pole inventory numbers are readable. What location method should they try?
- A resident claims a pothole photo is “on Main Street.” The storefront skyline matches a county road two towns over. What should public works do before dispatching a crew?
- The port’s public-facing OSINT cell has a photo of a crane with a unique ID painted on the boom. What should the analyst search?
- Parks is geolocating a trail photo that shows a trail-marker code listed in the city’s trail-map PDF. What should the analyst use?
- A weather-alert screenshot includes a National Weather Service zone and a radar thumbnail. How should the analyst use those public products?
- Reverse image, EXIF, and landmark checks disagree, and the PIO wants to publish a location anyway. What is the professional product?
Social Media OSINT · 50 questions
- A city public-information officer finds a public X post about a water-main break that copies the utility's live outage-map phrasing. What should the OSINT researcher do first?
- A transit authority wants to know whether a critic's X handle is a brand-new sock puppet or a long-running account. Which public artifacts should the researcher use first?
- Parks staff brief a quote-tweet as if the quoted sentence were written by the person who posted the quote. How should the OSINT report attribute that material?
- Emergency management needs wording from an X post that residents say was deleted after a storm warning. What counts as evidence in the OSINT report?
- A vendor's public X banner photo reverse-image-matches a completed streetscape in another city. How should the researcher treat that banner?
- The city clerk sees the same rumor about a permit freeze copy-pasted by a burst of newly created X accounts. What is the sound OSINT finding?
- Public works wants a subpoena for an X handle's IP address as the first step in reviewing a public complaint. What should the OSINT researcher do first?
- An X post about a public hearing carries a user-set location sticker that says "City Hall," but the photo shows landmarks from the county fairgrounds. What should the researcher trust for place?
- Procurement is reviewing a contractor who markets as a municipal specialist. How should the researcher use the contractor's public LinkedIn experience entries?
- Contractor due diligence finds a LinkedIn headline that still says "Director at City X" months after the person left that role. How should the researcher handle the headline?
- Economic development asks the researcher to scrape every LinkedIn connection of a chamber volunteer who is a private citizen. What collection scope fits civic OSINT?
- A LinkedIn recommendation for a vendor names a Riverfront Promenade rebuild that does not appear on the city's public project list. How should that mismatch be handled?
- An analyst is logged into a personal LinkedIn account while reviewing a vendor's public profile, and the vendor can see who viewed. What should the researcher do?
- Open-data staff find a public PDF resume that matches a vendor contact's LinkedIn profile except the employment dates differ by two years. What belongs in the report?
- A vendor's LinkedIn company page lists people who do not appear on the firm's public website roster. How should the researcher use that list?
- Sister-city staff see an "Open to work" banner on a contractor's public LinkedIn and want it logged as a security incident. How should the researcher treat the banner?
- A council member wants every public like on a critic's LinkedIn post named as a co-conspirator in a civic dossier. What should the OSINT report do?
- Code enforcement is forwarded a Facebook post showing a junk-filled yard. What is the public OSINT path?
- A Facebook event for a park concert lists an address that contradicts the parks department calendar. What should the report include?
- The fire public-information officer finds a Facebook profile using the department patch as an avatar and soliciting donations. What is the OSINT product?
- Housing staff find a Facebook page that claims to be the official housing authority, but the vanity URL differs by one letter from the real civic page. What should the researcher do?
- A vendor's Facebook check-in at City Hall is offered as proof the vendor attended a bid opening. How should the researcher treat the check-in?
- Library programming wants photos from a Facebook album of a branch opening. Some albums are friends-only. What may the researcher use?
- Public works sees a Facebook Marketplace listing that uses a photo of a marked city truck. What is the OSINT path?
- Parks staff want an Instagram geotag treated as exact coordinates for a playground inspection. How should the researcher treat the geotag?
- A procurement analyst reviewing paving bids notices that four competing city contractors post the identical crew-at-the-jobsite photograph on their public Instagram grids. What should that reuse be treated as?
- Tourism staff find a still-public Instagram highlight showing a mural the city has not unveiled. What is the correct OSINT handling of that highlight?
- 311 receives an Instagram close-up of graffiti with no street signs, storefronts, or other block context. What should the analyst do instead of inventing a location?
- The marina's public Instagram tags include a handle whose spelling matches the local-part of a dock-waitlist complaint email. How should that public tag be used?
- Historic preservation wants to measure a cornice from an Instagram photo that applies a heavy beauty filter warping the facade. What is the sound mensuration judgment?
- A TikTok of a flooded bike path includes audio of a unique school's public PA announcement. Besides the picture, what should the analyst treat as a place clue?
- Transit staff see a TikTok stitch that makes it look as if a bus driver confessed on camera. What should the analyst do before attributing those words?
- Solid-waste leadership wants to treat TikTok comments on a recycling video as a statistically valid citywide community survey. How should those comments be handled in an OSINT product?
- A viral TikTok labeled a city-worker leak is filmed in a generic office, and reverse image search of a wall poster hits a stock-background pack. What does that finding mean?
- The city subreddit has a post with a unique pothole photograph. Besides saving the image, what should collection of that Reddit artifact include?
- Public-works staff want the legal name of a Reddit user who posted a photo criticizing a paving job. The civic need is to find the failed curb in the picture. What is in OSINT scope?
- A Reddit AMA presenter claims to be a city engineer, but no matching LinkedIn profile or staff-directory entry can be found. How should that claimed role be treated?
- Deleted Reddit comments about a zoning hearing still appear on a public third-party mirror. How should the analyst cite them?
- An elections rumor appears first in a small city subreddit, then spreads with far more engagement on X. What should the civic rumor timeline identify?
- Public Snap Map-class content shows a crowd at a municipal reservoir. How should that ephemeral geo-social item be handled?
- A vendor's Snapchat brag reaches 311 only as a forwarded screenshot; the original snap is gone. What can the analyst honestly do with that artifact?
- Parks youth-program staff ask for Snapchat OSINT on minors at a skate park after a noise complaint. What is the correct collection boundary?
- The same unique illegal-dumping photograph appears on Instagram, on Reddit, and in a Facebook group screenshot. What should cross-platform correlation seek?
- A LinkedIn headline, an X bio, and an Instagram bio all use the same unusual municipal-project hashtag. What OSINT function does that rare string serve?
- The PIO wants one official social URL per platform, and OSINT has found look-alike city accounts on four networks. What in-scope product should the analyst deliver?
- A public Facebook post is later mirrored as a TikTok whose caption tells a different story. How should the TikTok caption be treated?
- A Reddit username matches an Instagram handle, but the display photographs differ. What does that handle equality mean?
- The city's real X account has been idle for months while a Facebook fan page posts official-sounding road closures. What should OSINT document?
- A city contractor's Instagram is public, but the matching LinkedIn profile is locked to connections. What is the correct OPSEC and collection choice?
- After capturing public posts on three platforms, the timestamps conflict with the claimed incident window. How should the OSINT report present that?
Website, Business, and Wireless · 50 questions
- A paving vendor's homepage looks newly redesigned, but the footer still names an LLC that the state's business search shows as dissolved. How should the OSINT researcher treat that mismatch?
- After a CMS cutover, the city clerk's live site returns 404 for an old marriage-license form, but a web archive still shows the page. What is the sound website-OSINT move?
- Procurement asks for WHOIS on a snow-removal vendor's domain, and the public record shows a privacy proxy instead of a person's name. What should the researcher report?
- A domain registered last week mimics the city's hostname and advertises a "city grants portal" the PIO never launched. What is the appropriate OSINT action?
- Parks procurement reviews a playground-vendor site whose homepage brand does not match the organization named on the public TLS certificate. How should that mismatch be used?
- The city's open-data robots.txt disallows /drafts, but that path still loads in a browser if the URL is known. What is the correct OSINT reading?
- View-source on the housing-application site shows HTML comments that still name a staging hostname. What should the PORP-style researcher do?
- Transit riders are sent to a service-status page on a domain that is not the city's root. What is the website-OSINT task?
- The assessor portal's browser-visible response headers name a common web stack. How should that fact be handled in PORP-scope website OSINT?
- A parks concession vendor's public sitemap.xml still lists staff-bio URLs that the current navigation no longer shows. What does that inventory give the researcher?
- Library IT notices the same unique analytics tracking ID on a vendor's real site and on a look-alike phishing page. What is the OSINT value of that ID?
- An emergency-alert landing page shows one contact phone today and a different number in an older archive capture. What should the researcher produce?
- Public-works DNS still resolves an old ftp. hostname to a parked page. What is the PORP-appropriate finding?
- A "pay your ticket" site uses the city's logo, but public registration data places the registrar in a country the city never uses for official domains. What should the researcher document for the city attorney?
- The convention bureau's English homepage lists different sponsors than its public translated subdomain. What should collection cover?
- A vendor 404 page shown to the permitting desk includes a real internal ticket URL pattern. What is the PORP method?
- A neighborhood blog embeds a public map iframe that appears to be city GIS. What should website OSINT establish?
- A snow-salt vendor's bid name returns no hit in the state's business-entity search. What should business OSINT do next?
- A paving firm's state filing lists different officers than the company's LinkedIn page. How should those sources be weighted?
- Occupancy licensing needs to know whether a food-truck vendor's public health permit is currently active. Which source class is the primary business-OSINT check?
- Economic development forwards "news" hits on a factory prospect that are word-for-word reprints of the company's press release. How should those hits be treated?
- A contractor's brochure claims "20 years serving the city," but public council award agendas only show the firm from two years ago. What should the researcher use as civic history?
- A housing-rehab vendor's website names a bonding company. What is the sound business-OSINT check?
- Port procurement finds the same registered-agent street address on ten otherwise unrelated "local" LLCs bidding work. How should that cluster be reported?
- A nonprofit applying for a city arts grant has a Form 990 on a public nonprofit-research site, and a council member wants the group's private donor roll. What is in-scope for PORP-style collection?
- A city procurement analyst is vetting a “local IT support” vendor that claims every technician lives in the county. Public job ads on the vendor’s careers page and job boards list every opening in another metro. What should the analyst do with that OSINT?
- A stormwater program is vetting a contractor. A public court-index search shows the firm as a defendant on a prior municipal project, and sealed filings are not available. What is the correct OSINT use of that result?
- A parks concession bidder claims year-round full staffing. The firm’s public local-business listing is flagged permanently closed and shows empty hours. What should the OSINT report say?
- Economic development is reviewing a sister-city gift vendor whose brochure names a single domestic factory. Public bill-of-lading-class databases list a different overseas manufacturer as the shipper of record. How should the analyst treat that?
- Fleet management is comparing two “competing” tow-contract bids. Public filings show both companies using the same EIN. What is the due-diligence finding?
- A parks concessionaire’s bid packet highlights five-star reviews. The public review page shows dozens of five-star posts all timestamped within the same afternoon and with near-identical wording. What should the analyst conclude?
- A public-works construction bid is still open. The city’s own business-license portal shows the firm’s license expired last month. What is the OSINT finding?
- An economic-development prospect lists a downtown headquarters on letterhead. Public property and occupancy records show that suite as a virtual-office mail drop shared by dozens of entities. What should the analyst report?
- Due diligence on a “longtime local” vendor finds a live website, but no matching license, no news hits, and no civic filings in the expected public indexes. How should the report characterize that?
- Municipal IT asks for a map of guest-Wi-Fi SSIDs around City Hall. Which PORP-appropriate method should the analyst use?
- A 311 photo shows a sandwich board advertising “free public Wi-Fi” with an SSID that does not match the city’s published guest network name. What is the correct first OSINT step?
- Transit advertises an onboard SSID on every bus. A public wireless map shows that same SSID string at a warehouse miles from any route. What should the analyst treat that as?
- Parks staff ask the OSINT analyst to recover the community-center Wi-Fi passphrase “from open sources.” What is the correct response?
- Public works documents a unique SSID prefix on fleet vehicles. A public wireless map shows that prefix clustered near a known depot. How should the analyst use it?
- A patron complains of a fake hotspot at a library branch. Branches publish “Library-Guest” as the official SSID. What should wireless OSINT start with?
- During a city festival, a vendor hotspot SSID concatenates a payment-brand string with the city name. What should the OSINT product include?
- Open data publishes a current map of city access points. The analyst’s public wardriving-class pull is dated three years earlier and shows APs the live map no longer lists. What should the report do?
- A public wireless dataset tags a housing-authority community-room SSID to a residential tower. A supervisor wants the unit number of a specific tenant from that pin. What is the correct limit?
- The PIO wants OSINT to jam a suspected fake “CityHall-Free-WiFi” SSID on the plaza. What is the PORP-appropriate action?
- A public wireless dataset lists a BSSID near City Hall whose OUI maps to a manufacturer that is not on the city’s AP contract. How should the analyst treat that?
- A traveler tweets a screenshot of a municipal airport-authority guest Wi-Fi prompt. What is the correct wireless-OSINT use of that screenshot?
- Code enforcement configured a “hidden” civic SSID, but a public wardriving-class map still prints the network name. What should the analyst explain?
- A public wireless map shows an SSID that matches the water plant’s internal SCADA network name, which should never be broadcast off-site. What is the correct product?
- A consultant proposes “wireless OSINT” for the library that consists of capturing handshakes and running aircrack-class attacks against guest and staff networks. How should the PORP candidate classify that work?
- A “local” vendor’s public surfaces show a two-week-old domain, a mail-drop headquarters in property records, and a matching SSID observed only in another state. What should the analyst deliver?
Tools, Automation, and Reporting · 50 questions
- A 311 desk receives a dumped-mattress photograph with no address on the ticket. A clerk opens a username-hunter first. Which tool class should the analyst use for the location problem?
- Procurement has only a bidder email address on a bid packet and no website or photograph. Which tool class should the analyst open first?
- Parks leadership bookmarks an OSINT Framework-style index and treats that page as a finished investigation of a concession vendor. How should the analyst treat the site?
- Library IT bookmarks twenty trial people-finder SaaS products to research one public handle from the staff directory. What should the analyst do instead of tool sprawl?
- Code enforcement has only a public username from a complaint post and no domain name. Which tool class is the right first pivot?
- A 311 callback field contains only a phone number and no social handle. Which tool class should the analyst use first?
- The public information office reports a fake social account impersonating the fire department. Which tool class should the analyst open first?
- Open-data staff treat an OSINT framework link directory as the case-management system for a vendor review. Where should findings actually be stored?
- A vendor tells the clerk that a paid people-search SKU is the only real OSINT for a permit applicant. How should the analyst proceed?
- GIS wants an all-in-one link-analysis graph populated before any URL or screenshot is captured on a parcel dispute. What is the correct use of that tool class?
- Two breach-lookup tools disagree on whether a procurement email appears in a public exposure corpus. What belongs in the report?
- Historic preservation installs a browser extension that phones home with every civic URL visited during research. What OPSEC choice should the analyst make?
- An OSINT framework tree lists a dark-web market scraper beside search and image tools. Which families stay in-scope for PORP-style civic work?
- Transit has a bus-stop photograph that also needs map correlation to confirm the shelter. How should the analyst choose tools?
- The clerk asks which OSINT tool proves a Facebook post about a washout is authentic. What should the analyst say?
- Occupancy licensing profiles a contractor website and learns the CMS type. Staff want to treat that output as a vulnerability to attack. How should the analyst treat it?
- A new intern runs only one favorite username tool and skips phone and email pivots even though those identifiers are on the complaint. What methodology should the analyst apply?
- Open-data staff want a script that requests a vendor website every second to automate website OSINT. What judgment should the analyst apply?
- A bulk WHOIS script returns 200 rows and an analyst pastes them unreviewed into a council packet. What should happen first?
- Parks wants a job that screenshots every Instagram hashtag matching the city name, forever. What is the PORP-aligned automation pattern?
- Website OSINT automation can pull public sitemaps and archive captures for five named vendor domains. How does that job differ from a citywide crawl of all residents?
- Housing staff want a scripted browser to log into a sock puppet and send friend requests to fifty landlords. What should the analyst do?
- The library research VM stores lookup-service API keys in a public gist for convenience. What should the analyst do with those secrets?
- Stormwater automation saved HTML from a contractor page that later changed. What is the saved copy for?
- A regex email finder run on a city PDF harvests strings from image timestamps that look like addresses. What should the analyst do before the report?
- A county grants office wants an analyst to paste a vendor URL list into a generative model and ship whatever it writes as the OSINT report, with no screenshots or source captures. What should the analyst do?
- Public works schedules a nightly automated crawl of a paving contractor's website, including paths the site's robots.txt already lists as disallowed. What is the professional OSINT choice?
- A housing-authority team automates screenshot jobs for vendor pages, but the captures crop out the address bar and show no retrieval time. What evidence standard should the analyst enforce?
- An intern launches a highly parallelized lookup tool against a city vendor's public site. The vendor's web application firewall fires, and the vendor calls the mayor's office about an apparent attack. What should the analyst have done?
- A library consortium due-diligence task has five vendor URLs and matching archive links. A junior analyst insists on writing a crawler before collecting anything. What is the right call?
- During a parks vendor-background drill, the same unusual tagline appears on a company website, a public resume, and a social-media bio. What method should the analyst use?
- A rumor about a closed rec-center pool is spreading on neighborhood forums. Staff want to open every OSINT tool they have before writing down what the city actually needs to know. What workflow should the analyst require?
- After an overnight collection job, an intern drops a raw JSON export on the housing director's desk and calls it the OSINT briefing. What should the analyst do instead?
- A county procurement OSINT packet on a paving vendor is due Monday morning. The analyst spends the weekend in one social-media rabbit hole and never drafts the report. What time-management practice was required?
- Parks leadership asks for an OSINT memo that lists conclusions only and skips the methods so it stays short. What should the analyst include?
- A water-utility rumor report includes a stack of screenshots with no captions and no pointers from claims to images. What reporting standard should the analyst apply?
- The city clerk wants a vendor-research report written as one long story instead of answering each assigned question. What structure should the analyst use?
- A draft county vendor report says the contractor is obviously lying, but it cites no public record that contradicts the contractor's statement. What language standard should the analyst enforce?
- Two days after a permitting OSINT memo ships, several cited vendor URLs return 404. What citation practice should have been in the report?
- The public-information officer asks to strip every username from a report about a public account impersonating the city library. What identifier practice should the analyst follow?
- A time-boxed city clerk OSINT packet has six questions of mixed difficulty. An intern starts the hardest identity puzzle and ignores the rest. What engagement sequence should the analyst use?
- A transit due-diligence plan reserved a final review hour, but staff skip it and ship a report that names the same vendor three different ways and mislabels screenshots. What should have happened?
- During a live, time-boxed civic OSINT drill, staff start posting the assigned questions into a public Discord server to crowdsource hints. What is the professional rule?
- An intern copies a blank penetration-test template with exploit narrative, proof-of-concept, and CVSS sections for a parks vendor OSINT memo. What should the analyst use instead?
- A stormwater OSINT finding is footnoted only as Google. What citation should the analyst require?
- Two county analysts reach opposite conclusions about whether a vendor's public officer list matches a bid packet, each citing different sourced pages. What should the professional report do?
- Emergency management asks that a washout-rumor OSINT product be just a tweet, with no methods or evidence attached. What should the analyst deliver?
- Screenshots in a port-authority vendor report show the analyst's personal bookmarks bar, a logged-in mail icon, and hobby folders. What evidence-hygiene step is required?
- A procurement due-diligence OSINT memo describes conclusions but never lists the search operators, reverse-image checks, web-archive captures, or secretary-of-state filings that produced them. What should the analyst add?
- At the civic OSINT deadline, three assigned questions have sourced evidence and two are still thin. Staff want to miss the cutoff chasing one more clue. What should the analyst do?
Identity Pivots · 50 questions
- A city procurement analyst is performing OSINT on a vendor whose public website has no contact page. How should the analyst discover email addresses for the due-diligence file?
- A city utility PDF from several years ago still lists an employee's personal Gmail in the footer of an old fact sheet. What is the sound OSINT treatment of that address?
- The clerk's office sees [email protected] on staff directories and wants to assume a contractor uses the same pattern on a private vendor domain. What should the OSINT analyst do?
- Housing-authority due diligence turns up a landlord contact of [email protected]. How should the analyst treat that address as an identity pivot?
- Grants staff find an applicant's email in a public breach-lookup service. What is the appropriate OSINT finding to report?
- Civic IT security asks the OSINT analyst to get the password from a public dump so staff can log into a vendor SSO. What should the analyst do?
- A permit applicant's email appears in a 2013 public dump and in no later public corpora the analyst can find. How should licensing be briefed on risk?
- Parks fundraising OSINT finds a public Gravatar-class avatar tied to a donor email. How should the analyst use that image?
- Transit OSINT finds the same vendor email on a city RFP-response PDF and on a personal blog. What does that correlation support?
- An open-data CSV on the city portal accidentally includes extra email columns. An analyst mirroring the portal for OSINT should treat those addresses how?
- Economic development asks the analyst to generate every possible email permutation for a target firm and mail all of them. What is the PORP-aligned response?
- A public-health inspector's work email appears in a third-party conference attendee PDF. What should the analyst record as the finding?
- A solid-waste vendor's domain shows many addresses in a public breach index. How should the analyst brief vendor-risk staff?
- The library consortium finds a staff email in a public dump and wants the leaked password printed in the council packet. What belongs in the civic OSINT report?
- A 311 complainant email is a plus-addressed variant of a known civic critic's mailbox. How should the analyst treat it?
- A fleet vendor lists different emails on WHOIS, the company website, and a state contractor registry. What should the analyst do?
- Elections staff look up a campaign email in public breach-index tools and get no hits. What does that result mean?
- A snow-plow contractor's website lists a distinctive handle in the footer. What is the highest-value next OSINT step?
- Code enforcement sees the handle cityhallfan12 on a complaint screenshot and assumes it uniquely identifies one resident. What should the analyst warn?
- Procurement finds a project manager's PDF resume on a personal site listing City of X — 2019. How should the analyst use it?
- Housing staff find two vendor PDFs with the same display name but different middle initials. What is the correct people-OSINT move?
- An analyst uses the assessor's public owner-name search to see who is listed on a parcel tied to an illegal dump site. What does the owner-of-record listing establish?
- A people-search aggregator page mixes a city engineer with a same-name dentist in another state. How should the civic analyst treat that profile?
- Parks OSINT finds a distinctive username on a trail forum and the same string on a code-repo profile that lists the city as employer. What does that pair support?
- Library staff doing public-facing research on a contractor find an old resume that omits a bankruptcy news story. How should people OSINT treat those sources?
- A county procurement analyst runs a username-hunter tool on a vendor contact’s common firstlast pattern and receives 40 hits across games, blogs, and forums. What should the analyst do next?
- Transit safety asks an analyst to identify a busker from a username shown on a public platform clip of a station plaza. What is the correct OSINT boundary?
- A port-authority vendor page advertises a public community server where points of contact use the same discriminator-style ID. How should that string be treated?
- A grant applicant’s public resume lists “Deputy Director of Harbor Resilience,” a municipal title the city has never used. What should people OSINT do first?
- Open-meeting minutes list a speaker as Jonathan M. Hale, while public social usernames use JonnyH. What is the sound identity move?
- Building-department staff paste a contractor into a people-search site that lists relatives. The civic task is confirming the contractor’s public business identity. What should the analyst collect?
- A unique display name appears in a municipal team-chat archive that was accidentally published on the city’s open-data portal. How should the analyst handle that handle?
- Economic development finds a founder’s CV hosted on a public university staff page. How should that source be used?
- Parks due diligence finds two public handles that differ by one character: citytree1 and citytreel. What should the analyst do?
- A 311 complaint includes a callback number. What is the analyst’s next lawful OSINT step?
- Parks finds a VoIP number on an illegal dump-site flyer. What should phone OSINT infer about location?
- County elections, in a jurisdiction that publishes a public voter roll, needs to confirm a petition signer’s status. How should that roll be used?
- A vendor’s public campaign-finance listing on the state portal shows a phone number that also appears on a paving-company website. How should the analyst treat the match?
- Clerk staff find a public birth-index listing, in a state that publishes indexes, that may distinguish two same-name contractors. What is the correct OSINT use of that index?
- An animal-control found-pet poster lists a number that reverse-lists to a shared commercial call center. What should the analyst conclude?
- The housing authority sees a disposable app-provisioned number on a rental flyer. How should that number be treated?
- A public property card lists the owner’s mailing address as a PO box. How should people OSINT treat that address?
- Stormwater asks an analyst for a callback number’s “current GPS” from OSINT. What should the analyst explain?
- A public resume PDF lists a cell number that also appears on a published city-council comment signup sheet. What does that overlap support?
- Library staff find a birth year on an old community-award page and a different year on a public resume. What should they do with the dates?
- Occupancy licensing looks up a tradesperson on the state professional-license board, which lists a phone; a people-search scrape shows a different number. Which source should lead for civic identity?
- A public voter-roll address is a campus dorm, while a vendor application lists a suburban house. What should the analyst record?
- Port procurement sees a phone formatted with a foreign country code on a website that claims to be a local vendor. What is the sound next OSINT move?
- Public health asks an analyst to “find anyone named Maria at that restaurant” with no other public identifier. What should the analyst do?
- After email, username, phone, and public-roll checks, only the email is corroborated. The PIO still wants a full biographic dossier. What should the analyst deliver?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by TCM Security.