Comprehensive and Detailed Explanation (ECIH-aligned):

Unauthorized access to backend services in a cloud environment most commonly results from overly permissive identity and access management (IAM) configurations. The ECIH cloud incident handling guidance emphasizes that identity controls are the primary security boundary in cloud platforms.

Option A is correct because reviewing and tightening IAM roles immediately reduces the attack surface and revokes excessive privileges that may be exploited. This action directly addresses the root cause of unauthorized access.

Option D is a strong additional control but should be applied after correcting IAM misconfigurations. Option B improves future detection but does not contain the current incident. Option C is disruptive and unnecessary as a first response.

Therefore, IAM review and privilege tightening is the correct first measure, consistent with ECIH best practices.