C, D correct

https://help.salesforce.com/s/articleView?id=sf.resetting_and_expiring_passwords.htm&type=5

Only an admin can reset single sign-on (SSO) user passwords.
After resetting a password, users are sometimes required to activate their devices to successfully log in to Salesforce.
Resetting a locked-out user’s password automatically unlocks the user’s account.

As you can see, single sign on users can not reset passwords themselves.

Correct answer is B and C.
Explanation:
B. Single sign-on users can reset their own passwords using the forgot password link.

C. Resetting a locked-out user's password automatically unlocks the user's account.

Option A is incorrect because resetting the user's password does not change the password policy. The policy is set by the administrator and applies to all users.

Option D is also incorrect because resetting a password does not affect the device activation process.

Option B is one of the correct options because single sign-on users can reset their own passwords using the forgot password link. This is because single sign-on allows users to access multiple applications with one set of login credentials.

Option C is the other correct option because resetting a locked-out user's password automatically unlocks the user's account. This is because the lockout is usually triggered by too many unsuccessful login attempts, and resetting the password effectively clears this trigger.