You are creating an Azure AD conditional access policy. You want to enforce multi-factor authentication for a selected set of users when logging on to sharepoint online. 
Which controls should you configure? Select three options.

Answer options:

A.Users and groups
B.Cloud apps or actions
C.Conditions
D.Grant
E.Session

Correct Answers: A, B and D 
Under Users and groups, you target the selected users: 

Under Cloud apps or actions, you select Sharepoint online: 

Under Grant you select the action that will be enforced, in this case granting access after MFA authentication: 

Option C is incorrect. Conditions control user access based on signals from conditions like risk, device platform, location, client apps, or device state.
Option E is incorrect. Sessions Control user access based on session controls to enable limited experiences within specific cloud applications.
Reference: 
To know more about password enabling MFA in Conditional access, please refer to the link below: 

https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa