After a server has been attacked, which of the following is the BEST course of action?

A. Conduct a security audit
B. Review vulnerability assessment
C. Isolate the system
D. Initiate incident response