Which of the following tools would MOST LIKELY be used to perform security audit on various of forms of network systems?

An Intrusion Detection System passively monitors traffic for known attack signatures in real time and does not actively probe systems to enumerate vulnerabilities for an audit.

A vulnerability scanner such as Nessus or OpenVAS actively interrogates hosts, services, and configurations across a network to identify known CVEs, missing patches, weak credentials, and misconfigurations. It produces structured audit reports covering multiple attack surfaces simultaneously, which is exactly what a broad security audit of various network systems requires. Its automated, policy-driven scanning approach is the accepted standard in technical security audit workflows.

A port scanner identifies open ports and running services but does not assess whether those services are vulnerable or misconfigured, providing only a fraction of the data required for a full security audit.

A protocol analyzer captures and decodes network traffic for troubleshooting or forensic purposes but does not scan for vulnerabilities or misconfigurations across network systems.