The county board asks whether nation-state actors are targeting U.S. local government this year so it can set budget and risk appetite. Which threat-intelligence tier answers that question?
Select an answer to reveal the explanation.
Short Explanation
The board is asking for the weather forecast, not tonight's radar blip. "Are nation-states hunting cities this year?" is strategic intel — intent, trends, risk appetite. A hash list or one C2 IP is a raindrop, not the climate briefing.
Full Explanation
The county board asks whether nation-state actors are targeting U.S. local government this year so it can set budget and risk appetite. The intelligence tier that answers that question is strategic intelligence on adversary intent and civic targeting trends. Civic framing matters because boards set municipal risk appetite and funding; they need trend and intent context, not a single overnight hash or one threat-list hit.
Answering with technical indicators such as last night's malware hashes fails by concept: technical intel supports matching and blocking observables, not multi-month board risk questions. Relying on a single Enterprise Security threat-list lookup of one C2 IP fails by concept: one IoC match is an operational/technical datum, not a targeting-trend briefing. Using only tactical TTPs describing how one encryptor names files fails by concept: tactical detail explains adversary methods for detection design, not whether nation-states are prioritizing local government this year.
Exam caveat: SPLK-5001 intel-tier questions map the consumer's decision—board budget and appetite = strategic; do not hand the board a hash list and call it answered.
Operational check: Deliver a strategic brief on nation-state interest in U.S. local government for the board packet, keep hash and C2 work in the SOC's technical/operational lanes, and separate risk-appetite decisions from overnight IoC triage.