The Conditional Access chapter of SC-300 states that administrators block legacy protocols by targeting them with the Client apps condition. The guide notes: "Client apps lets you target policy by application type such as browser, modern authentication c lients, and legacy authentication clients ." It gives the prescriptive action:
"To block legacy authentication, configure a policy with Client apps set to 'Other clients' (legacy) and grant control = Block ." In contrast, Cloud apps or actions chooses the service (e.g., Office 365), User risk and Sign- in risk apply risk-based controls, not protocol filtering. Therefore, to filter out and prevent legacy authentication attempts, you must configure Conditional Access with the client apps condition targeting legacy
/other clients and block them, exactly as taught in the SC-300 objectives "Configure and manage Conditional Access."