A cloud credential is confirmed compromised and remains usable. Which approach best fits?

1. Revoke the compromised access path and investigate related activity.
2. Use approved artifact analysis and threat-intelligence services.
3. Isolate the affected endpoint using the approved containment procedure.
4. Correlate identities, artifacts, timelines, and affected resources across available evidence.