Explanation

Box 1:
The C2R (click-to-run) version of Microsoft Visio only will be uninstalled from the computers.
To remove the MSI version of Microsoft Visio, you would need to specify the RemoveMSI parameter. The RemoveMSI parameter is not configured in the configuration file in this question. Therefore, only the C2R version will be installed.
Box 2:
If the Office share on Server1 is missing the Japanese language pack, Office 365 ProPlus will be installed in English only.
In the configuration file, English is the first in the list above Japanese. Therefore, English is the primary language and the installation will continue in English only.
Reference:
https://docs.microsoft.com/en-us/deployoffice/configuration-options-for-the-office-2016-deployment-tool

Explanation
The setting "Admins and users in the guest inviter role can invite" is set to No. This means that no one can create guest accounts because they cannot 'invite' guests. This setting needs to be changed to Yes to ensure that guest users can be created in the tenant.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/b2b/delegate-invitations
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions

Explanation

Box 1:
When the installation is complete, all users will be prompted to install several updates.
In the configuration file, the Updates Enabled element is set to True. This means that Office will check for updates after the installation.
The Channel element set to Broad means that all semi-annual channel updates will be installed.
Box 2:
Office 365 ProPlus will be installed only on the computers that run a 64-bit version of Windows 10.
The OfficeClientEdition element defines whether the 32-bit or 64-bit edition of Office 365 ProPlus is downloaded or installed. In the configuration file, it is set to '64'. The 64-bit version will only install on a
64-bit client computer.
Reference:
https://docs.microsoft.com/en-us/deployoffice/configuration-options-for-the-office-2016-deployment-tool

Explanation

By default, smart lockout locks the account from sign-in attempts for one minute after 10 failed attempts. In this question, the lockout threshold if 5 failed attempts. The account locks again after each subsequent failed sign-in attempt, for one minute at first and longer in subsequent attempts.
Password evaluation goes through several steps including normalization and Substring matching which is used on the normalized password to check for the user's first and last name as well as the tenant name.
The next step is to identify all instances of banned passwords in the user's normalized new password. Then:
* Each banned password that is found in a user's password is given one point.
* Each remaining unique character is given one point.
* A password must be at least five (5) points for it to be accepted.
Conto$01Pa$$word contains two banned passwords and no remaining unique characters so is given a score of
2 points. This is less than the required 5 points so will be rejected.
Pa$$w0rd contains a banned password and no remaining unique characters so is given a score of 1 point. This is less than the required 5 points so will be rejected.
AzureAD!!111 contains a banned password (AzureAD!!) and has three remaining characters. However, the remaining characters are all the same (they're all 1s) so that is only one unique character. So that password will be given a score of 2. One for the banned password and 1 for the unique character. This is less than the required 5 points so will be rejected.
Password11 does not contain a banned password. Password11 contains 10 characters. However, there are two
's' and two '1' so there are 8 unique characters. Therefore, the password will be given a score of 8 points. This is more than the required 5 points so the password will be accepted.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart-lockout

Explanation:
References:
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles