【单选题】
An administrator is investigating an incident where an unauthorized user gained access to a servera nd modified HR files.The administrator has a tested theory as to how the user accomplished this.Which of the following actions should the administrator take NEXT？（）
A、Perform a root cause analysis.
B、Implement a change to the servers.
C、Establish a plan of action to resolve the issue.
D、Question users prior to implementing the solution.
查看正确答案
