Access to a sensitive application should require a compliant device and stronger authentication under defined conditions. Which capability should be configured?

1. An Azure resource lock
2. Conditional Access
3. A retention label
4. An access review as the sign-in policy engine