The correct option is Leveraging the Threat dashboard to gain broad visibility into global threat activity.

Leveraging the Threat dashboard to gain broad visibility into global threat activity is correct because the dashboard aggregates telemetry from across the service and surfaces campaign level trends and indicators. The Threat dashboard helps investigators link observed phishing to broader campaigns and known actor groups by showing attribution data and related indicators of compromise.

Concentrating on the total number of mail items scanned by the tenant is incorrect because raw scan counts only show volume and do not provide campaign attribution or insights into threat actor types.

Using Attack simulation reports to evaluate user susceptibility to phishing is incorrect because attack simulations measure user behavior and training effectiveness and they do not reveal where real campaigns originate or the likely actor profiles behind them.

Using Threat explorer to investigate individual malware and malicious message details is incorrect because Threat Explorer is focused on hunting and investigating specific messages and artifacts inside your tenant and it is not designed to provide broad global campaign attribution or actor profiling at the same level as the Threat dashboard.

Full AWS Practitioner Certification Question