Responders see a possibly compromised service account and need to understand recent supported administrative activity before containment. Which approach best fits?

1. Correlate Cloud Audit Logs with resource and identity context.
2. Monitor source ingestion health and alert on unexpected silence.
3. Revoke or disable the compromised credential and investigate affected access.
4. Use Security Command Center findings and risk-management capabilities.