Given the following information about a company's internal network: User IP space: 192.168.1.0/24 Server IP space: 192.168.192.0/25 A security engineer has been told that there are rogue websites…

A protocol analyzer (packet capture) running on the 192.168.1.0/24 subnet will reveal HTTP and HTTPS traffic originating from hosts in that range, exposing unauthorized web servers that are serving content outside the designated 192.168.192.0/25 server space.

A port scanner targeting 192.168.1.0/24 will enumerate open ports on each host, and any machines with ports 80 or 443 open are candidates for rogue web servers operating in the user address space rather than the authorized server subnet.

An HTTP interceptor on the user subnet captures outbound client browsing requests and responses, not the presence of servers hosting rogue sites on those same machines.

Scanning the legitimate server space 192.168.192.0/25 would only enumerate authorized servers; rogue websites are explicitly defined as hosted outside this range.

A protocol analyzer on the authorized server subnet 192.168.192.0/25 monitors traffic to and from known servers and would not reveal rogue services running in the user IP space.

An HTTP interceptor on the server subnet 192.168.192.0/25 monitors communication with authorized servers and cannot identify unauthorized web servers operating in the 192.168.1.0/24 user range.