A security analyst is reviewing the security of a company's public-facing servers. After some research, the analyst discovers the following on a public pastebin website. Which of the following…

Reviewing system logs is a reactive investigative step appropriate after a breach is confirmed, not the immediate priority when an external exposure has just been discovered on a public site.

Data found on a public pastebin often includes credentials, subdomain lists, API keys, or configuration details that reveal the company's external attack surface. Scanning all *.company.com subdomains allows the analyst to identify which systems are vulnerable before a threat actor can act on the exposed information. This proactive enumeration and vulnerability assessment step is essential to understanding the scope of exposure and prioritizing remediation.

Root cause analysis is performed after an incident has been scoped and contained, not as the first action when the full extent of the potential compromise is still unknown.

Changing the MySQL database password is a narrow targeted remediation that presumes the database is the only asset at risk, whereas the analyst must first assess the full scope of what was exposed before taking isolated remediation actions.