C: Privileged Access Workstation (PAW)
This is the highest security configuration designed for extremely sensitive roles that would have a significant or material impact on the organization if their account was compromised. The PAW configuration includes security controls and policies that restrict local administrative access and productivity tools to minimize the attack surface to only what is absolutely required for performing sensitive job tasks. This makes the PAW device difficult for attackers to compromise because it blocks the most common vector for phishing attacks: email and web browsing.
D: As shown in the diagram, privileged access management builds on the protection provided with native encryption of Microsoft 365 data and the role-based access control security model of Microsoft 365 services. When used with Azure AD Privileged Identity Management, these two features provide access control with just-in-time access at different scopes.

Reference:
https://docs.microsoft.com/en-us/security/compass/privileged-access-devices
https://docs.microsoft.com/en-us/microsoft-365/compliance/privileged-access-management-overview?view=o365-worldwide

Explanation:
You can generate automatic captions and a transcript for your Microsoft Stream (Classic) videos.
Reference:
https://docs.microsoft.com/en-us/stream/portal-autogenerate-captions

Explanation:
https://docs.microsoft.com/en-us/deployoffice/change-management-for-office-365-clients
https://docs.microsoft.com/en-us/office365/admin/manage/release-options-in-office-
365?view=o365-worldwide#set-up-the-release-option-in-the-microsoft-365-admin-center

https://docs.microsoft.com/en-us/office365/securitycompliance/atp-safe-links