SECOPS-PRO Question #75: Real Exam Question with Answer & Explanation

An incident response team is investigating a potential breach involving an internal server communicating with a suspicious external IP address. Initial checks on VirusTotal for the external IP yield no results. Upon further investigation, network telemetry suggests the communication pattern is highly unusual and indicative of command-and-control (C2) activity. The team needs to determine if this C2 traffic is associated with a known threat actor, understand their TTPs, and identify specific exploit methods. Which of the following distinct characteristics, when comparing WildFire, Unit 42, and VirusTotal, are most critical for the team to leverage in this situation? (Select all that apply)