An attacker changes a user's cloud refresh-token access while the password is reset. What additional action may be necessary?

1. Revoke affected sessions and tokens according to the identity platform's capabilities
2. Delete only the incident alert
3. Change the user's display name only
4. Rotate an unrelated application's public certificate