If an administrator does not have a NIDS examining network traffic, which of the following could be used to identify an active attack?

A.
Protocol analyzer

B.
Penetration testing tool

C.
Network mapper

D.
Vulnerability scanner