Microsoft Entra self-service password reset (SSPR) supports multiple verification methods that users can register and use to prove their identity during a reset. Microsoft's documentation lists the SSPR methods as:
"Mobile app notification," "Mobile app code," "Email," "Mobile phone (text message or call)," "Office phone," and "Security questions." Administrators choose which of these are allowed and how many methods are required. During the reset flow, SSPR "prompts the user to verify with the registered methods" before permitting a password change. Notably, certificates and picture passwords are not SSPR verification methods in Microsoft Entra ID. Therefore, among the options provided: a text message to a phone (mobile phone), a mobile app notification (Microsoft Authenticator), and security questions are valid SSPR authentication methods; certificate and picture password are not supported for SSPR. This aligns with SCI learning content that positions SSPR as a user-empowering capability to securely restore access using admin-approved methods without help-desk intervention.

Explanation:
No
No
Yes
Microsoft states that Communication Compliance is administered in Microsoft Purview, not the Microsoft
365 admin center. The Learn article shows configuration and policy templates "in the Microsoft Purview portal" and directs admins to "configure Communication Compliance" there, confirming the management plane is the Purview compliance portal, not the M365 admin center.
Regarding supported locations, Microsoft lists the communication channels that policies can inspect:
"Microsoft Teams... Exchange Online... Viva Engage... [and] Third-party sources." SharePoint Online is not listed among supported channels, so SharePoint content isn't monitored by Communication Compliance policies.
Finally, Communication Compliance includes built-in workflows to address findings. The Learn page explicitly provides a Remediate step: "Remediate Communication Compliance issues you investigate by using the following options:" such as "Notify the user" and "Escalate to another reviewer." These actions demonstrate that the solution does more than detect; it supports remediation within the Purview portal workflow.
Exact extracts (selected):
* "You can choose from the following policy templates in the Microsoft Purview portal."
* "Communication Compliance policies check... Microsoft Teams... Exchange Online... Viva Engage...
Third-party sources."
* "Remediate Communication Compliance issues you investigate by using the following options: Notify the user... Escalate to another reviewer."

Conditional Access session controls enable user app access and sessions to be monitored and controlled in real time based on access and session policies.
Based on this definition, the best answer for your question is B. enable limited experiences, such as blocking download of sensitive information.
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-session

When you register an application through the Azure portal, an application object and service principal are automatically created in your home directory or tenant.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

Microsoft describes Azure Policy as the built-in governance service that lets you "create, assign, and manage policies" to enforce organizational standards and "assess compliance at scale." It continuously evaluates existing resources for compliance and can take effect-enforcement actions such as deny, append, or modify during create/update operations. Azure Policy "helps you audit and enforce your standards" across subscriptions and resource groups, and its compliance dashboard shows overall and per-policy compliance states for all resources. By contrast, Azure Blueprints focuses on orchestrating deployments of artifacts (such as policy assignments, role assignments, and templates) for new environments; Microsoft guidance positions Policy as the engine that evaluates and enforces those standards on existing resources. Sentinel is a SIEM
/SOAR for security analytics, and Anomaly Detector is a Cognitive Service-not a governance/compliance enforcement tool. Therefore, to assess compliance and enforce standards for existing Azure resources, the prescribed control plane is Azure Policy with its evaluation cycle, initiative (policy set) support, and remediation tasks.