A security team sees repeated alerts for one compromised access key. Which action directly contains that credential's use?

1. Increase the key's permissions to simplify monitoring
2. Rename the account without changing the credential
3. Revoke or disable the key and investigate affected activity
4. Wait for the next scheduled annual access review