Explanation:

SC-300 materials explain that Conditional Access (CA) evaluates assignments (who/what) and conditions
/exclusions before applying grant controls. Policy CA1 targets Group1 and requires MFA, but explicitly excludes Global Administrator and Group2. User1 is in Group1 and holds the Global Administrator role, so the directory-role exclusion means CA1 does not apply and no other policy targets User1 # no MFA prompt.
Policy CA2 targets Group2 and blocks access to all cloud apps, with an exclusion for Group3. User2 is in Group2 and not in Group3, so CA2 applies and blocks SharePoint Online sign-in. User3 is in Group2 and Group3; because Group3 is excluded from CA2, the block does not apply. User3 is not in Group1, so CA1 doesn't apply either; therefore, User3 can sign in normally. The SC-300 guidance also notes that exclusions take precedence over inclusions, and block access is an enforcing control when a matching policy applies, while policies are evaluated independently with the most restrictive applicable outcome applied per user and sign-in.