Conditional Access policies is the correct answer.

Conditional Access policies let administrators build granular rules that target particular users and groups and that evaluate sign in signals such as location, device state, and risk. These policies provide access controls that can require multifactor authentication when the specified conditions are met, so administrators can require MFA for selected users, groups, and for specific sign in events.

Authentication methods policy is incorrect because it is used to configure which authentication methods are available and how users register those methods rather than to apply conditional rules that require MFA for selected users or sign in conditions.

Security defaults is incorrect because it provides a basic baseline of protections and can enable MFA for privileged tasks, but it does not support the fine grained targeting of specific users, groups, and sign in scenarios that Conditional Access policies allow.

Azure AD Identity Protection is incorrect because it focuses on detecting risky sign ins and compromised accounts and on triggering risk based remediation such as requiring MFA for risky events, but it is not the primary policy engine for broadly requiring MFA for selected users and arbitrary sign in conditions in the way that Conditional Access policies are.

Full AWS Practitioner Certification Question