Explanation:
Box 1: No
Box 2: No
Box 3: Yes
Note: By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned.
With a two-gate policy, administrators don't have the ability to use security questions.
The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number.
Reference:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr- policy#administrator-password-policy-differences