Explanation:
Box 1: No
Two methods are required (Mobile phone and Security questions).
Box 2: No
Self-service password reset is only enabled for Group2, and User1 is not a member of Group2.
Box 3: No
To be able to add Security questions to the process, you need to be a Global Administrator.
User3 is User Administrator, so User3 cannot add security questions to the reset process. User Administrator doesn't have MFA permissions.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr
https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory- passwords-faq
https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable- sspr#prerequisites
https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user- administrator