The most recent vulnerability scan flagged the domain controller with a critical vulnerability. The systems administrator researched the vulnerability and discovered the domain controller does not run the associated application with the vulnerability. Which of the following steps should the administrator take next?


A. Ensure the scan engine is configured correctly.
B. Apply a patch to the domain controller.
C. Research the CVE.
D. Document this as a false positive.