A network administrator with a company's NSP has received a CERT alert for targeted adversarial behavior at the company. In addition to the company's physical security, which of the following can…

RAS (Remote Access Service) facilitates and manages remote dial-in connections but does not provide monitoring or detection capabilities for internal physical threats.

A vulnerability scanner probes systems for known weaknesses and misconfigurations but does not monitor for real-time adversarial activity or detect an active intruder.

HTTP intercept proxies inspect web application traffic for malicious content in transit but are scoped to HTTP sessions and cannot detect physical access events or broader network intrusions.

A Host-based Intrusion Detection System (HIDS) monitors file integrity, system calls, logs, and process activity on individual endpoints, making it capable of detecting unauthorized local access or privilege escalation by a physical intruder.

A port scanner enumerates open ports on hosts at a point in time but is not a continuous monitoring tool and would not alert on the presence of a physical intruder.

A protocol analyzer (packet capture tool) passively captures and inspects all network traffic traversing a segment, allowing an administrator to identify anomalous data flows, lateral movement, or exfiltration attempts initiated by someone with physical network access.