An administrator is investigating an incident where an unauthorized user gained access to a servera nd modified HR files.The administrator has a tested theory as to how the user accomplished this.Which of the following actions should the administrator take NEXT？（）

• A、Perform a root cause analysis.
• B、Implement a change to the servers.
• C、Establish a plan of action to resolve the issue.
• D、Question users prior to implementing the solution.