A security administrator suspects a MITM attack aimed at impersonating the default gateway is underway. Which of the following tools should the administrator use to detect this attack? (Select two.)

Ping only tests basic ICMP reachability to a host and returns round-trip time, but provides no information about routing paths or gateway identity that would indicate impersonation.

Ipconfig (or ipconfig /all) displays the system's current default gateway IP address and can reveal if it has been altered by an attacker; comparing this against known-good values helps identify ARP poisoning or gateway impersonation that redirected traffic to a rogue host.

Tracert traces the actual hop-by-hop route packets take to a destination, so if a MITM attacker is impersonating the default gateway, the first hop shown by tracert will reveal an unexpected or rogue IP address instead of the legitimate gateway, exposing the interception.

Netstat displays active TCP/UDP connections and listening ports on the local machine, which is useful for detecting unauthorized services but does not reveal gateway impersonation or routing manipulation.

Dig is a DNS query tool used to resolve domain names and inspect DNS records; it does not provide information about Layer 2/3 gateway identity or routing paths relevant to a MITM gateway attack.

Nslookup queries DNS servers to resolve hostnames and is useful for diagnosing DNS spoofing, but it does not reveal information about the default gateway's identity or the physical routing path of traffic.