Active exploitation can use unpatched software, hardware, or other vulnerabilities to gain control of systems, networks, or devices.

### Why this is right Active exploitation takes advantage of vulnerabilities to gain control of systems, networks, or devices. The material specifically includes unpatched software and hardware among possible weaknesses. ### The concept A vulnerability is a weakness that an attacker can exploit. If a weakness remains unpatched, an attacker may take advantage of it before the organization applies an update. These attacks can go unnoticed, so planning should describe mitigation measures, which may include temporarily suspending internet access or ceasing online activity. Identified vulnerabilities should be addressed through patching and updates. ### The other options - **False**: This would incorrectly deny the relationship between exploitation, vulnerabilities, and gaining control. ### Terms - **Active exploitation**: Taking advantage of a vulnerability to gain control of systems, networks, or devices. - **Unpatched**: Not yet updated to address a known or identified weakness. ### Remember Exploitation uses a weakness; patching is one way to address that weakness.