A network administrator with a company's NSP has received a CERT alert for targeted adversarial behavior at the company. In addition to the company's physical security, which of the following can…

RAS (Remote Access Service) provides remote connectivity to a network but has no detection or scanning capability for identifying malicious actors already present on the internal network.

A vulnerability scanner identifies software weaknesses and misconfigurations in systems but does not detect the active presence or behavior of a malicious actor on the network.

HTTP intercept captures and inspects web traffic but is limited to HTTP sessions and cannot detect a physically present intruder accessing non-web resources or internal systems.

A Host-based Intrusion Detection System (HIDS) monitors activity directly on individual hosts, alerting administrators to unauthorized access attempts, file changes, or suspicious processes that an internal threat actor might trigger on a system they have physically accessed.

A port scanner can enumerate open ports and active services on internal network devices, helping detect unauthorized devices or rogue connections introduced by an intruder who has gained physical access to the network.

A protocol analyzer passively captures and decodes network traffic and requires manual human analysis to identify threats, so it does not actively scan for or alert on a malicious actor's presence.