During a security incident investigation, the SOC team discovers that an Instana API token used by an automated deployment pipeline has been exfiltrated and may have already been used to query monitoring data. What is the correct immediate remediation action for the Instana administrator?

API tokens in Instana are independent bearer credentials that can be created and revoked without affecting user accounts or other authentication sessions. Revoking the compromised token immediately cuts off unauthorized API access, and generating a new token allows the pipeline to resume operations with a fresh credential. Resetting passwords or rotating TLS certificates does not address a compromised API token, as tokens are independent of those mechanisms. The correct answer is 'Revoke the compromised API token immediately from Settings > API Tokens and generate a replacement token for the pipeline'. The incorrect options — 'Disable SAML SSO temporarily to prevent the attacker from escalating privileges through the identity provider', 'Reset all Instana user passwords and force re-authentication across the tenant', 'Rotate the backend TLS certificate to invalidate any active sessions established with the compromised token' — are wrong because they do not align with IBM Instana's architecture or recommended practices for this scenario. Understanding this concept is essential for the Domain 7: Security/Compliance domain of the IBM Instana Observability certification.