Explanation:

You are using Azure Cognitive Search, where access is controlled by:
Admin keys: Provide full read/write control (never given to apps).
Query keys: Provide read-only access, meant for client apps.
Here, the query key has been compromised. You want to minimize downtime and ensure continued read-only access.
Step 1 - Add a new query key
First, generate a new query key from the Azure portal or via REST API.
This allows you to continue providing read-only access to authorized apps.
Step 2 - Change the app to use the new key
Update the application configuration so that it authenticates requests with the new query key.
This ensures uninterrupted service while preparing to retire the compromised key.
Step 3 - Delete the compromised key
Once the app is using the new key successfully, revoke the compromised query key.
This prevents further unauthorized usage.
Why not other options?
Regenerate primary/secondary admin key: Not necessary since only the query key is compromised, and admin keys give full control.
Change app to use secondary admin key: Insecure (admin keys should never be exposed to client apps).
Correct Sequence
Add a new query key.
Change the app to use the new key.
Delete the compromised key.
Microsoft References
Manage admin and query keys in Azure Cognitive Search
Create and use query keys