Arnold, a forensic investigator, was tasked with analyzing a corporate network that was suspected of...

According to theCHFI v11 Network Forensics, Incident Detection, and SIEM objectives,Security Onionis a widely used open-source platform designed specifically fornetwork security monitoring, intrusion detection, and forensic analysis. It integrates multiple tools such asSnort/Suricata (IDS/IPS),Zeek (Bro)for network traffic analysis,Elastic Stack, andSIEM capabilities, providing deep visibility into network activities.

In the given scenario, Arnold required a solution capable ofanalyzing live and stored network traffic,monitoring access points,detecting anomalies, andidentifying rogue or unauthorized devices. Security Onion fulfills all these requirements by collecting and correlating logs, monitoring network behavior, and generating alerts for suspicious patterns such as unknown MAC addresses, abnormal traffic flows, and unauthorized access point activity.

The other options do not align with the scenario.Time Machineis a macOS backup utility, not a network forensic tool.Promqryis used for querying Prometheus metrics and is not designed for forensic traffic analysis.Fretais a cloud-based memory forensics tool focused on Linux runtime analysis, not network-wide access point monitoring.

CHFI v11 emphasizes the use ofSIEM and network monitoring platformslike Security Onion for detecting rogue devices, investigating unauthorized access, and performing evidence correlation using network logs and alerts. Therefore, the correct and CHFI-verified answer isSecurity Onion (Option D).