Using Intelligent Threat Cloud Service

Dear all, With regards to using the threat intelligent cloud service the new feature that is introduced in SEP, in which clients doesn't store any definations locally on the disk and perform a cloud lookup when doing a scan. I would like to know which Symantec URLs the endpoints would try to access when they perform a cloud lookup so that the required exclusions can be made on Firewall and Proxy?

Also what would be the approximate size of each reputation query the clients would be making?

Appreciate your responses. Thanks