A user's account is compromised and may have active sessions and connected application tokens. Which approach best fits?

1. Configure Marketplace application allowlisting and installation policy.
2. Create an appropriately scoped activity rule or alert.
3. Review and restrict the application's granted scopes using supported API controls.
4. Contain the account using appropriate session reset, credential, and token-revocation steps.