Match each cybersecurity incident or environment term with its correct description: Terms: 1. Ransomware 2. Data theft 3. Active exploitation 4. Secured environment Descriptions: A. Taking advantage of a system weakness to gain unauthorized control of devices or networks B. Restricting what information is permitted to enter or leave the network C. Encrypting files or systems to demand payment in exchange for restoring access D. Illegally obtaining or exfiltrating information stored on servers or devices

### The pairs | Item | Matches | Why | |---|---|---| | Ransomware | Locks files or systems and demands a ransom | Ransomware makes information or systems inaccessible and seeks payment, without guaranteeing that payment will restore access. | | Data theft | Stealing information stored on servers or devices | Data theft concerns information being taken, often after access with stolen user credentials. | | Active exploitation | Using a vulnerability to gain control of systems, networks, or devices | Exploitation takes advantage of a weakness to gain control and may occur before a patch is applied. | | Secured environment | Restricts what information may enter or leave the network | A secured environment limits information flow, unlike an open environment. | ### The concept The incident types are distinguished by their mechanisms: locking access, stealing information, or exploiting a weakness. Environment terms instead describe information-flow restrictions. Keeping these categories separate helps a response team identify what it is observing and select relevant planning measures. ### Terms - **Vulnerability**: A weakness that can be taken advantage of to compromise a system or network. - **User credentials**: Information used to authenticate a user and gain access. ### Remember Classify the activity by its mechanism, and distinguish threat types from environment settings.