Hi Alex Tao ,

You can enable both the MFA factors to the respective groups in identity engine as well as classic engine.

Identity engine

1. Navigate to Security > Authenticators
2. Enable Phone (for SMS) and Security Question from the authenticators list
3. Create an enrollment policy in which both Phone & Security question as Required and assign the policy to the respective groups.

Classic Engine

1. Navigate to Security > Multifactor
2. Enable SMS Authentication & Security Question from the factor types.
3. Create a Multifactor Policy by making these two as Required and assign the policy to respective groups.

Please do upvote if this address your query.