A confirmed compromised workload is actively using an exposed credential. Responders are authorized to contain the incident and need reliable evidence for investigation. Which two actions are appropriate? Select 2 answers.

1. Preserve relevant artifacts and activity evidence with controlled handling.
2. Create a replacement credential while leaving the compromised one usable.
3. Revoke the exposed credential and contain the affected access path.
4. Delete all activity logs immediately to reduce the attacker’s visibility.
5. Declare recovery solely because one suspicious alert is closed.