A server technician is investigating a potential data breach. It is believed that the breach occurred via telnet access. Which of the following could validate this hypothesis?

Telnet operates on TCP port 23, and a port scanner can probe the target host to determine if that port is currently open or can be correlated with firewall and IDS logs to show historical access. This provides direct evidence supporting or refuting the hypothesis that an attacker connected via Telnet. Tools like Nmap are standard for this type of network reconnaissance and validation.

Cipher tools deal with encryption and decryption of data and would not reveal whether a plaintext Telnet session was established.

A checksum analyzer verifies file integrity by comparing hash values and has no capability to detect network protocol activity.

A TDR (Time Domain Reflectometer) is a physical-layer cable testing tool used to locate faults in copper cabling, not to investigate network protocol usage.