Explanation:

Microsoft's Identity Protection provides risk-based detections and automated policies-not group management. Microsoft Learn explains that Identity Protection "uses detections to identify potential vulnerabilities affecting your organization's identities" and exposes user risk and sign-in risk for policy decisions. It does not support adding users to groups by "risk level"; group membership is handled by static or dynamic rules based on directory attributes, while risk is a transient signal surfaced to policies.
Identity Protection includes specific detections such as "Leaked credentials", where Microsoft's threat intelligence finds credentials "on the dark web or other dumps," and flags the affected account as risky. This directly confirms the ability to detect whether credentials have been exposed publicly.
For enforcement, Identity Protection policies and Conditional Access can require stronger authentication when risk is present. The documentation states that you can configure policies to "require multi-factor authentication for sign-ins assessed as risky" and use Conditional Access conditions like User risk or Sign-in risk with the grant control Require multi-factor authentication. Thus, Identity Protection signals can invoke MFA based on risk, but they do not place users into groups.

Explanation:
access and application control
In Microsoft Defender for Cloud, the capabilities grouped as access and application control are designed to harden Azure virtual machines by limiting both what can access a VM and what can run on it. Microsoft's documentation explains that Adaptive application controls "help you control which applications can run on your VMs by allowing only known-safe applications," which directly helps block malware and other unwanted applications. In the same family, Just-in-time (JIT) VM access "reduces exposure to attacks by locking down inbound traffic to your VMs and opening only the required ports, for approved users, for a limited time," thereby reducing the network attack surface. These capabilities are surfaced in Defender for Cloud recommendations and policies to enforce least privilege at the network edge and on the endpoint execution layer.
By contrast, Cloud Security Posture Management (CSPM) provides continuous assessment and secure-score- driven recommendations but isn't the control that actively blocks applications or time-bounds inbound access.
Container security targets container images and runtimes, and vulnerability assessment identifies software vulnerabilities but doesn't enforce allow-listing or time-bound access. Therefore, the correct completion is access and application control, which encompasses Adaptive application controls and JIT VM access to protect VMs from unwanted apps and minimize exposed network surface.

Explanation:
Box 1: Yes
Microsoft Secure Score has updated improvement actions to support security defaults in Azure Active Directory, which make it easier to help protect your organization with pre-configured security settings for common attacks.
If you turn on security defaults, you'll be awarded full points for the following improvement actions:
- Ensure all users can complete multi-factor authentication for secure access (9 points)
- Require MFA for administrative roles (10 points)
- Enable policy to block legacy authentication (7 points)
Box 2: Yes
Each improvement action is worth 10 points or less, and most are scored in a binary fashion. If you implement the improvement action, like create a new policy or turn on a specific setting, you get 100% of the points. For other improvement actions, points are given as a percentage of the total configuration.
Note: Following the Secure Score recommendations can protect your organization from threats.
From a centralized dashboard in the Microsoft 365 Defender portal, organizations can monitor and work on the security of their Microsoft 365 identities, apps, and devices.
Box 3: No
Compliance Manager gives you an initial score based on the Microsoft 365 data protection baseline. This baseline is a set of controls that includes key regulations and standards for data protection and general data governance. This baseline draws elements primarily from NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and ISO (International Organization for Standardization), as well as from FedRAMP (Federal Risk and Authorization Management Program) and GDPR (General Data Protection Regulation of the European Union).
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score
https://learn.microsoft.com/en-us/microsoft-365/compliance/compliance-score-calculation?view=o365-worldwide