A company wants only approved Workspace Marketplace applications available to employees. Which approach best fits?

1. Configure Marketplace application allowlisting and installation policy.
2. Create an appropriately scoped activity rule or alert.
3. Contain the account using appropriate session reset, credential, and token-revocation steps.
4. Review and restrict the application's granted scopes using supported API controls.