Overview

The correct method to get detailed information about the sign-in interruption is to review the Azure AD sign-in events to see which Conditional Access policy or policies were applied and why.

Privileged Role Administrator can manage role assignments in Azure Active Directory, as well as within Azure AD Privileged Identity Management.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-role-administrator

Password admin cant reset the password of User4, User6, User7, and User 8.

Note: User 8 can't be reset because he's an admin, User 4 can't because he's not in the organization, and User 6 and User7 can't because they have elevated permissions.

Password admin cant reset the password of User4, User6, User7, and User 8.

Note: User 8 can't be reset because he's an admin, User 4 can't because he's not in the organization, and User 6 and User7 can't because they have elevated permissions.

New York office NAT IP is in MFA trusted IP list. So, NO. MFA will NOT be prompted.

New York office NAT IP is in MFA trusted IP list. So, NO. MFA will NOT be prompted.

Correct A finance department user who works from home who has an IP Address as 193.77.140.140 will be prompted for Azure MFA credentials.

Montreal private IP range is trusted in Azure AD Named Location which is not valid for MFA. MFA has its own trusted IP range at this moment although MS is trying to consolidate this two portal into unified portal with new preview feature. So, YES Fun fact : Yes, you can add public IP range into Named location at this moment although MS claimed it otherwise in new preview

The correct answer is user2 and user4 only. because -match Sea* means { Sea, Seaa, Seaaaaaa,...} in this case Seattle is excluded whereas -contain SEA means {*.SEA.*}

Strings and regex are case insensitive per the link. https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership#supported-values This means -contains "SEA" gets all users.