An external application requests excessive OAuth access to company data. Which approach best fits?

1. Review and restrict the application's granted scopes using supported API controls.
2. Configure Marketplace application allowlisting and installation policy.
3. Contain the account using appropriate session reset, credential, and token-revocation steps.
4. Create an appropriately scoped activity rule or alert.