The correct answer is B because the strace -c option produces a statistical summary showing, for each system call, the time spent, number of calls, and error counts. Linux tracing references describe this summary mode as the way to obtain aggregate syscall statistics instead of a full line-by-line trace. That matches the question exactly. The command shown in option B runs a sample command under strace with summary mode enabled and redirects normal command output away, leaving the syscall summary visible for analysis. Option A attaches to a process but does not request the summary table. Option C is malformed for the stated purpose, and option D writes a detailed trace to a file rather than generating the summarized count-time-error view. CHFI v11 includes Linux forensics, malware behavior analysis, and system-level examination, so recognizing the correct tool usage for syscall analysis fits directly within scope. When investigators want a compact overview of syscall frequency, time consumption, and errors to identify suspicious behavior patterns, the correct strace usage is the command with the -c summary option.