An employee account is believed compromised. The administrator must prevent further use and address existing sessions through supported mechanisms. Which response is appropriate?

1. Disable or otherwise restrict the account and revoke sessions as required by the incident process
2. Wait for the next quarterly access review regardless of risk
3. Change only the user's display photo
4. Increase the account's privileges to observe the attacker