Which is a / are best-practice(s) in a SAML 2.0 situation?
Solution: To never enable SAML for all your end-users

Which of the following is / are true?
Solution: If an MFA factor is set to 'required' and another MFA factor set to 'optional', then users can enroll into both factors, but then can use only the first one for successful logins

Regarding policies, Okta recommends:
Solution: To include a policy rule that catches not wanted behaviors as a first priority and then label others for permitted behaviors

On a Windows machine, which is the right behavior if you try to sign into your Okta org and agentless DSSO is properly configured for it?
Solution: You will be automatically redirected to your end user's apps dashboard without entering any credentials

When a user's Okta password is changed:
Solution: All apps that are Provisioning-enabled and have Update Attributes option active under Provisioning settings - will begin to sync the password in respective apps, as password is an attribute of their profile - but only if JIT Provisioning is enabled as well as it has to be a just-in-time action, the moment the user resets the password