You can’t “use” the account if you can’t log into it without the 2nd part of authentication. The problem with this question that I really hate is it leads to 2 different answers because it says prevent use but yet also talks about “policy”. Password History won’t do anything to prevent stolen credentials unless the policy being implemented instantly forces everyone to change their password “right now” which password history normally just means you can’t reuse the same password again after you are forced to change it be it a 30 days or 60 days later. MFA may not be a policy but it insantly prevents the issue of stolen credentials being used to log in after MFA has been enabled. It’s a stupid catch 22 question because MFA would fix the stolen credentials problem instantly. The moment the thieves use the password, a prompt for a Token digit (or whatever the 2nd authentication is) will be requested. MFA would definitely prevent.