A security incident involves a compromised workload identity. Which response best limits damage while preserving investigation evidence?

1. Grant additional tenancy administration to the affected identity.
2. Restrict or revoke the affected access, contain the workload, and preserve relevant audit and application records.
3. Change only the resource's display name.
4. Delete all logs before changing permissions.