Which of the following allows an administrator to view malicious activity after it has taken place?

Which of the following allows an administrator to view malicious activity after it has taken place?

A.
IDS

B.
IPS

C.
Port scanner

D.
Packet sniffer