Conditional Access session controls enable user app access and sessions to be monitored and controlled in real time based on access and session policies.
Based on this definition, the best answer for your question is B. enable limited experiences, such as blocking download of sensitive information.
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-session

Explanation
You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.

Reference:
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/get-started/