User 3 is a User Admin. So,
Box 1: 2
Why: By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced.

Box 2: Email, phone and Microsoft Authenticator only
Email,Phone,MFA selection can be chosen except Security Questions. Admins can't use it for SSPR.
Why: The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number, and it prohibits security questions.
A two-gate policy applies in the following circumstances:
.....
Security administrator
Service support administrator
SharePoint administrator
Skype for Business administrator
User administrator

Source:https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences