At a financial services provider ' s online trading platform in Boston, Massachusetts, forensic analysts...

The correct answer is D because a histogram is the view designed to show how response times are distributed across ranges, making it ideal for spotting clusters, skew, long tails, or intermittent delay bands that averages can hide. Sumo Logic’s IIS Log Analyzer documentation explicitly lists “Response times in histogram form” as one of the available views in the app. That makes it the most appropriate choice when analysts need to determine whether delays are concentrated in specific intervals rather than simply looking at aggregate throughput or server counts. Requests by server would help compare load across hosts, slowest pages would identify particular endpoints with high latency, and response throughputs would focus on volume over time. None of those directly answers the distribution question posed in the scenario. CHFI v11 includes IIS log analysis and web-application attack investigation, so candidates should be able to select the visualization that best supports a given forensic question. When the goal is to reveal response-time frequency patterns across the whole dataset, the correct analytic view is response times in histogram form.