What should be done first when setting up an IoT device?

Changing the administrator username and password is a critical first step when setting up an IoT device. This action significantly enhances the security of the device and the network it connects to. Many IoT devices come with default usernames and passwords, often publicly known or easily guessable, such as "admin" and "1234". If these are not changed, the device becomes vulnerable to unauthorized access and potential exploitation by malicious actors.

By changing the credentials to something unique, you mitigate the risk of unauthorized users being able to take control of the device and its settings—which could lead to privacy breaches, data theft, or the device being used in botnets for larger attacks. This practice is a fundamental security measure recommended by manufacturers and cybersecurity experts alike to ensure the protection of both the device and the broader network infrastructure.

The other options do not contribute to enhancing security in the same way. Keeping the existing username and password maintains the vulnerabilities inherent in defaults, and suggesting to perform a fun task does not address the critical need for security configuration. Thus, the best action is to change the credentials to safeguard the IoT device from potential threats.