Explanation
When onboarding Windows Defender ATP for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored.
The only way to change the location is to offboard the test devices then onboard them again with the new location.
Reference:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy

Either one of the following three roles can review the list in Azure AD Identity Protection of users flagged for risk:
* Security Administrator
* Global Administrator
* Security Reader
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risky-sign-ins

Explanation
An alert policy consists of a set of rules and conditions that define the user or admin activity that generates an alert, a list of users who trigger the alert if they perform the activity, and a threshold that defines how many times the activity has to occur before an alert is triggered.
In this question, we would use the "Malware detected in file" activity in the alert settings then configure the threshold (5 detections) and the time window (10 minutes).
The ability to configure alert policies based on a threshold or based on unusual activity requires Advanced Threat Protection (ATP).
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies

Explanation

Box 1: Yes.
User1 is in a group named Compliant. All the conditional access policies apply to Group1 so they don't apply to User1.
As there is no conditional access policy blocking access for the group named Compliant, User1 is able to access App1 using any device.
Box 2: Yes.
User2 is in Group1 so Policy1 applies first. Policy1 excludes compliant devices and Device1 is compliant.
Therefore, Policy1 does not apply so we move on to Policy2.
User2 is also in Group2. Policy2 excludes Group2. Therefore, Policy2 does not apply so we move on to Policy3.
Policy3 applies to Group1 so Policy3 applies to User2. Policy3 applies to 'All device states' so Policy3 applies to Device1. Policy3 grants access. Therefore, User2 can access App1 using Device1.
Box 3: No.
User2 is in Group1 so Policy1 applies. Policy1 excludes compliant devices but Devices is non-compliant.
Therefore, User2 cannot access App1 from Device2.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access

References:
https://docs.microsoft.com/en-us/sharepointmigration/introducing-the-sharepoint-migration-tool