Place the steps for responding to suspected active exploitation in the correct logical sequence.

### The order 1. **Recognize that an unpatched vulnerability may be exploited**: Active exploitation takes advantage of weaknesses in software, hardware, or other parts of the environment. 2. **Assess the issue and determine the mitigation needed**: Responders need to understand the incident before choosing a suitable action. 3. **Use an appropriate temporary restriction, such as suspending internet access or ceasing online activity**: Temporary restrictions can reduce an attacker's opportunity to cause further harm. 4. **Patch and update affected devices after identifying vulnerabilities**: Applying updates addresses identified weaknesses as part of resolution. ### The concept The source identifies temporary connectivity restrictions as possible mitigation for active exploitation and patching as a response to discovered vulnerabilities. The actions should be selected according to the incident rather than applied mechanically in every case. This ordering expresses a sensible planning logic, not a quoted mandatory sequence. ### Terms - **Patch**: A software or system update that addresses a vulnerability or other issue. - **Active exploitation**: Taking advantage of a vulnerability to gain control of systems, networks, or devices. ### Remember Identify the weakness, assess the risk, limit exposure when appropriate, then address the vulnerability.