Alejandro is an incident response analyst for a large corporation. He is on the midnight shift when an intrusion detection system alerts him to a potential brute-force password attack against one of the company's critical information systems. He performs an initial triage of the event before taking any additional action. If Alejandro's initial investigation determines that a security incident is likely taking place, what should be his next step? A Conduct a lesson-learned session. B Implement the right tools and sets up the right processes ahead of an incident occurring. C Activate the incident response team. D Investigate the root cause.