Explanation

Microsoft enforces a strong default two-gate password reset policy for any Azure administrator role. This policy may be different from the one you have defined for your users and cannot be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned.
With a two-gate policy, administrators don't have the ability to use security questions.
The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number.
User3 is not assigned to an Administrative role so the configured method of Security questions only applies to User3.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-passwo

We can create a threat management policy to alert us when the sharing policy is changed.
Create a new Alert policy > under Category select Threat Management > under 'Activity is' scroll down to the 'Site administration activities' and select 'Changed a sharing policy'.

Explanation

* Retention wins over deletion. Suppose that one retention policy says to delete Exchange email after three years, but another retention policy says to retain Exchange email for five years and then delete it.
Any content that reaches three years old will be deleted and hidden from the users' view, but still retained in the Recoverable Items folder until the content reaches five years old, when it is permanently deleted.
* The longest retention period wins. If content is subject to multiple policies that retain content, it will be retained until the end of the longest retention period.
Box 1: No.
The file will be deleted and hidden from the users' view, but still retained in the Recoverable Items folder. An administrator would need to recover the file.
Box 2: Yes.
The file will be deleted and hidden from the users' view, but still retained in the Recoverable Items folder. An administrator will be able to recover the file.
Box 3: Yes.
2018 to 2023 is five years. Policy2 has a retention period of four years. However, Policy2 is configured to not delete the files after the four-year retention period.
Reference:
https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies#the-principles-of-retention-or-

Explanation

Box 1: Yes
In the first exhibit, "Allow invitations to be sent to any domain (most inclusive) is enabled". Also, everyone is allowed to 'invite'. The Target Domains setting will have no effect. This would only apply if one of the Allow/Deny invitations to the specified domain options were selected.
There is a restriction that blocks invitations being sent to contoso.com. However, this restriction does not apply to Fabrikam.com. Therefore, you can share the files in Collection1 to [email protected].
Box 2: Yes
As noted above, external sharing is enabled for any domain except contoso.com. The Target Domains setting in the first exhibit will have no effect. Therefore, you can share Collection1 to [email protected].
Box 3: Yes
As noted above, external sharing is enabled for any domain except contoso.com. Blocking sharing to contoso.com does not block sharing to us.contoso.com. Therefore, you can share Collection1 to [email protected].
Reference:
https://docs.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off

See explanation below.
Explanation
Create an activity alert
1. Go to https://protection.office.com/managealerts.
2. Sign in to Office 365 using your work or school account.
3. On the Activity alerts page, click + New.The flyout page to create an activity alert is displayed.

4. Complete the following fields to create an activity alert:
* Name - Type a name for the alert. Alert names must be unique within your organization.
* Description (Optional) - Describe the alert, such as the activities and users being tracked, and the users that email notifications are sent to. Descriptions provide a quick and easy way to describe the purpose of the alert to other admins.
* Alert type - Make sure the Custom option is selected.
* Send this alert when - Click Send this alert when and then configure these two fields:
- Activities - Click the drop-down list to display the activities that you can create an alert for. This is the same activities list that's displayed when you search the Office 365 audit log. You can select one or more specific activities or you can click the activity group name to select all activities in the group. For a description of these activities, see the "Audited activities" section in Search the audit log. When a user performs any of the activities that you've added to the alert, an email notification is sent.
- Users - Click this box and then select one or more users. If the users in this box perform the activities that you added to the Activities box, an alert will be sent. Leave the box blank to send an alert when any user in your organization performs the activities specified by the alert.
* Send this alert to - Click Send this alert Recipients box and type a name to add a users who will receive an email notification when a user (specified in the Users box) performs an activity (specified in the Activities box). Note that you are added to the list of recipients by default. You can remove your name from this list.
5. Click Save to create the alert.The new alert is displayed in the list on the Activity alerts page.

The status of the alert is set to On. Note that the recipients who will received an email notification when an alert is sent are also listed.
References:
https://docs.microsoft.com/en-us/microsoft-365/compliance/create-activity-alerts?view=o365-worldwide