A security analyst is reviewing a large volume of alerts dur…
A security analyst is reviewing a large volume of alerts during a suspected phishing campaign. They are focused on identifying messages with known malicious subject lines and sender patterns. While doing this, they overlook an email that contains an unusual attachment and a clear warning sign, because it does not match the specific indicators they were concentrating on. Which concept best explains why the analyst failed to notice this important clue?