Explanation:
If a message is identified as a domain impersonation: the message is moved to the Junk Email folder According to the anti-phishing policy settings shown in the exhibit, messages identified as domain impersonation should be moved to the Junk Email folder to reduce the risk of phishing attacks.
To reduce the likelihood of the impersonation policy generating false positives, configure: Mailbox intelligence Mailbox intelligence helps in reducing false positives by using machine learning and historical email patterns to make better decisions about which emails are legitimate and which are not.

Explanation:

Explanation:

Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/close-or-delete-case?view=o365-worldwide

Explanation:
From the table in the question:
User1-User4 are On-premises (synced) with Password hash authentication.
User5-User6 are Cloud users (cloud-only).
Microsoft's licensing guidance for Self-Service Password Reset (SSPR) scenarios (which includes password change) states:
Cloud-only user password change (user knows their password and wants to change it) is available in Microsoft Entra ID Free.
Exact extract: "Cloud-only user password change ... Microsoft Entra ID Free" Hybrid user password change or reset with on-prem writeback (synced from on-prem using Entra Connect and writing the password back) requires Microsoft Entra ID P1 or P2 (or Microsoft 365 Business Premium).
Exact extract: "Hybrid user password change or reset with on-prem writeback ... Microsoft Entra ID P1 or P2" Because User1-User4 are synced (hybrid) users and must change passwords using a Microsoft 365 portal and keep passwords consistent with on-premises AD DS, they require password writeback, which requires P1 for those users.
Because User5-User6 are cloud-only users, they can change passwords with Entra ID Free.
Minimum licenses (cost-optimized)
Microsoft Entra ID P1 licenses: 4 (User1-User4)
Microsoft Entra ID Free licenses: 2 (User5-User6)