Explanation
Azure AD Password Protection detects and blocks known weak passwords and their variants, and can also block additional weak terms that are specific to your organization.
With Azure AD Password Protection, default global banned password lists are automatically applied to all users in an Azure AD tenant. To support your own business and security needs, you can define entries in a custom banned password list.

Explanation
Graphical user interface, text, application, email Description automatically generated

Box 1: Yes
A certificate is required that provides a private and a public key.
Box 2: Yes
The public key is used to validate the private key that is associated with a digital signature.
Box 3: Yes
The private key, or rather the password to the private key, validates the identity of the signer.

Explanation
Text, letter Description automatically generated

Biometrics templates are stored locally on a device. Reference:
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-overview