A and C. You can identify communications to CnC servers and malicious domains based on reputation by correlating DNS intelligence and other security events.