Option A. Wireshark is the best answer because the task is to analyze unusual network behavior and specifically monitor DNS requests . Wireshark is designed for packet capture and protocol-level inspection, allowing the investigator to examine DNS queries, responses, timing, source systems, suspicious domains, and other traffic details in depth.
This makes it more appropriate than the other options. Nmap is primarily a network scanning tool, useful for discovery and service enumeration, not deep DNS traffic inspection. Snort is an intrusion detection and alerting tool, and while it may detect suspicious activity, it is not the best primary choice for directly inspecting DNS packet contents in a forensic investigation. Nessus is a vulnerability scanner, not a live packet-analysis utility.
From a CHFI network-forensics viewpoint, packet capture and protocol analysis are central to understanding malware-related traffic patterns such as DNS tunneling, beaconing, command-and-control lookups, or suspicious domain resolution behavior. Since Lisa needs detailed visibility into abnormal DNS requests, Wireshark is the most suitable and effective tool for this investigation.