A security scan discovers an active credential in a workload's files. Which response is necessary beyond removing the file content?

1. Revoke or rotate the credential and investigate possible use
2. Disable the scanner permanently
3. Keep it active because the scanner found it internally
4. Rename the file only