Explanation
You can use the Get-MsolUser cmdlet to generate a report that lists all the users who completed the Azure MFA registration process. The full command would look like this:
Get-MsolUser -All | Where-Object {$_.StrongAuthenticationMethods.Count -eq 0} | Select-Object -Property UserPrincipalName Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-reporting

See explanation below.
Explanation
You need to add the contoso.com domain to Microsoft 365 then set the domain as the default.
1. In the Admin Center, click Setup then click Domains.
2. Click the 'Add Domain' button.
3. Type in the domain name (contoso.com) and click the 'Use this domain' button.
4. The question states that another administrator will perform the required information to your DNS zone.
Therefore, you just need to click the 'Verify' button to verify domain ownership.
5. Click Finish.
6. In the domains list, select the contoso.com domain.
7. Select 'Set as default'.
References:
https://docs.microsoft.com/en-us/office365/admin/setup/add-domain?view=o365-worldwide

See explanation below.
Explanation
You need to configure the Password Expiration Policy.
1. Sign in to the Microsoft 365 Admin Center.
2. In the left navigation pane, expand the Settings section then select the Settings option.
3. Click on Security and Privacy.
4. Select the Password Expiration Policy.
5. Ensure that the checkbox labelled "Set user passwords to expire after a number of days" is ticked.
6. Enter 60 in the "Days before passwords expire" field.
7. Enter 10 in the "Days before a user is notified about expiration" field.
8. Click the 'Save changes' button.

Explanation

Box 1: No
User1's password contains the banned password 'Contoso'. However, User1 will not be required to change his password at next sign in. When the password expires or when User1 (or an administrator) changes the password, the password will be evaluated and will have to meet the password requirements.
Box 2: Yes
Password evaluation goes through several steps including normalization and Substring matching which is used on the normalized password to check for the user's first and last name as well as the tenant name.
Normalization is the process of converting common letter substitutes into letters. For example, 0 converts to o.
$ converts to s. etc.
The next step is to identify all instances of banned passwords in the user's normalized new password. Then:
* Each banned password that is found in a user's password is given one point.
* Each remaining unique character is given one point.
* A password must be at least five (5) points for it to be accepted.
'C0nt0s0' becomes 'contoso' after normalization. Therefore, C0nt0s0_C0mplex123 contains one instance of the banned password (contoso) so that equals 1 point. After 'contoso', there are 11 unique characters.
Therefore, the score for 'C0nt0s0_C0mplex123' is 12. This is more than the required 5 points so the password is acceptable.
Box 3:
The 'Password protection for Windows Server Active Directory' is in 'Audit' mode. This means that the password protection rules are not applied. Audit mode is for logging policy violations before putting the password protection 'live' by changing the mode to 'enforced'.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad