Which two methods might be used by an analyst to detect SSL/TLS encrypted command-and- control communication? (Choose two.)

Performing decryption and inspection of SSL/TLS traffic (e.g., using a security proxy or Next-Generation Firewall) allows visibility into the encrypted payload to identify C2 signatures or anomalies.

Firewall HTTP application inspection is effective for unencrypted HTTP traffic but cannot directly inspect the content of encrypted SSL/TLS traffic without decryption.

IPS HTTP deep packet inspection would primarily focus on the unencrypted HTTP layer and would not be able to analyze the payload within an encrypted SSL/TLS tunnel without prior decryption.

Analyzing NetFlow data, which includes metadata like source/destination IPs, ports, and byte counts, can reveal anomalous TLS/SSL flow patterns, such as unusual connection frequencies or data volumes, even without decrypting the content.