A security engineer is configuring Microsoft Entra Conditional Access for an application that processes financial data. The policy must enforce that access is granted only when users are on compliant devices AND connecting from a named location AND have low sign-in risk. What grant controls and conditions must be set?

D is correct because the policy should Grant 'Require compliant device' and set Conditions > Locations to include only trusted named locations, and Conditions > Sign-in risk to 'Low' only. This configuration ensures all three conditions must be true simultaneously. A is incorrect because specifying 'Named locations (include)' without the trusted qualifier could include all named locations. B is incorrect because requiring MFA adds a condition not in the requirements, and medium risk exceeds the low risk requirement. C is incorrect because excluding all except trusted is functionally similar but D more accurately reflects the Conditional Access interface.