A company experiences ransomware after an employee approves an unexpected authentication request. Explain how the incident could involve both a human attack vector and a technical weakness, and name two response priorities.

### The concept Attack vectors can combine human manipulation with technical access. In an authentication-fatigue attack, an attacker repeatedly prompts a user until the user approves a request. That approval may give the attacker a valid account session, which can then be used to access systems or deploy malware. The case requires evidence before assigning cause: responders should examine authentication logs, account activity, endpoint alerts, and the sequence of events. Containment may include disabling sessions or accounts and isolating compromised devices. Investigation should determine whether data was accessed or removed as well as encrypted. ### What a good answer covers - The user approval is a social-engineering route. - Compromised authentication can provide technical access. - Containment should limit account use and malware spread. - Investigation should establish scope, evidence, and possible data exposure. ### Terms - **Authentication**: The process of verifying a user's identity. - **Multi-factor authentication (MFA)**: Identity verification using multiple types of evidence. ### Remember A human action can become the initial step in a technical compromise.