A security analyst is reviewing the security of a company's public-facing servers. After some research the analyst discovers the following on a public pastebin website. Which of the following should…

Reviewing system logs is an important investigative step but it comes after the immediate threat of credential exposure is contained, not before the compromised password is changed.

Scanning company subdomains for vulnerabilities is a useful broader security activity but does not address the specific, time-sensitive risk of publicly exposed database credentials.

Root cause analysis is a post-incident process that follows containment and eradication; performing it before changing the password leaves the database exposed to exploitation for the entire duration of the analysis.

Credentials found on a public pastebin represent an actively known-compromised secret that must be invalidated immediately to close the attack window; changing the MySQL password revokes access for any threat actor who has already retrieved the credentials, and this containment action takes priority over all investigative steps which can safely proceed after the immediate risk is mitigated.