Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation under "Manage Administrative Units in Azure Active Directory", Administrative Units (AUs) provide a way to delegate administrative permissions over subsets of Azure AD resources - such as specific users or groups - without granting directory-wide privileges.
* Department1 Administrative Unit contains User1, User2, Group1, and Group2.
* Admin1 is assigned the User Administrator role scoped to Department1 AU.
* Admin2 is assigned the User Administrator role scoped to the entire directory.
# Context Overview
* User3 and User4 are not members of Department1 AU - they belong only to Group2, but group membership does not automatically bring those users under AU scope.
* Admin1's permissions are limited strictly to users and groups within the Department1 AU. # Conclusion: Admin1 cannot reset the passwords of User3 and User4. Answer: No Statement 1: Admin1 can reset the passwords of User3 and User4.
* Both User1 and Group2 are in the Department1 AU, but in Azure AD, the User Administrator role scoped to an AU cannot manage group memberships unless explicitly delegated with Group Administrator privileges or unless the AU is configured to allow it.
* The User Administrator role allows password reset and user management, not group membership management. # Conclusion: Admin1 cannot add User1 to Group2. Answer: No Statement 2: Admin1 can add User1 to Group2.
* Admin2 has the User Administrator role assigned at the directory level, meaning global scope.
* Therefore, Admin2 can manage user credentials, including password resets, for all users in the tenant - including User1. # Conclusion: Admin2 can reset the password of User1. Answer: Yes Statement 3: Admin2 can reset the password of User1.
Supporting Reference (Microsoft Learn):
"Administrative units restrict scope for delegated administrators. A User Administrator scoped to an AU can reset passwords only for users in that AU. A User Administrator assigned at the directory level can reset passwords for any user."