The correct answer is All legacy authentication requests are blocked.

Security defaults in Azure Active Directory enable a tenant wide baseline of protection and they block legacy authentication protocols because those protocols do not support modern authentication features such as MFA. As a result authentication attempts that use protocols like POP, IMAP, SMTP AUTH, and older Office clients are denied when security defaults are turned on.

Legacy authentication remains allowed for some users is incorrect. Security defaults apply across the tenant and do not permit selective exceptions for some users.

Enforcement defers to Conditional Access policies is incorrect. Security defaults provide a built in baseline and do not rely on Conditional Access policies, and organizations typically disable security defaults if they want to manage controls with Conditional Access instead.

Legacy authentication prompts for additional verification such as MFA is incorrect. Legacy protocols generally do not support modern authentication flows and cannot perform MFA, so security defaults block those requests rather than prompting for additional verification.

Full AWS Practitioner Certification Question