The correct answers are A legacy distribution list can be migrated to a Microsoft 365 group in the admin center, Security groups can be assigned to control access rights on resources and applications and Creating a Microsoft 365 group also provisions a shared mailbox and a group calendar.

A legacy distribution list can be migrated to a Microsoft 365 group in the admin center is correct because the Microsoft 365 admin center provides tools to convert distribution lists into Microsoft 365 groups while preserving membership and email addresses. That conversion moves the list into the groups framework so members gain the collaboration features that groups provide.

Security groups can be assigned to control access rights on resources and applications is correct because security groups in Azure Active Directory and Microsoft 365 exist to grant permissions and to manage access to resources and applications across the tenant.

Creating a Microsoft 365 group also provisions a shared mailbox and a group calendar is correct because a Microsoft 365 group is a collaboration construct that by default provisions an Exchange mailbox, a shared calendar and other services such as a SharePoint site and Planner for the group's members.

Every user who accesses a shared mailbox must have an individual Microsoft 365 license is incorrect because shared mailboxes can be used without individual licenses while they remain within Microsofts size and feature limits. Licensing may become necessary if you enable archive or if you convert the shared mailbox to a regular user mailbox so the licensing rule depends on usage rather than mere access.

Full AWS Practitioner Certification Question