The correct answers are Verify the company domain, Create and manage directory groups and Approve pending user access requests.

Verify the company domain is allowed because organization administrators manage organization wide identity and domain settings and they are responsible for proving ownership of the company domain for single sign on and directory integration.

Create and manage directory groups is permitted because groups are an organization level identity resource used to grant and centralize access and policies across projects and services and the organization admin manages those directory resources.

Approve pending user access requests is permitted because approving requests to join the organization is an organization wide user management action and falls within the responsibilities of the organization administrator.

Configure an inbound mail handler for issues is incorrect because inbound mail handlers are typically configured at the project or product level inside an issue tracker and not as an organization wide admin function.

Send an invitation by email is incorrect because sending invitations often requires user management or identity provider permissions and is not guaranteed to be included in the organization admin role.

Remove unmanaged accounts is incorrect because unmanaged accounts are not controlled by the organization directory and removing them usually requires the account owner or support processes rather than a standard organization admin action.

Full AWS Practitioner Certification Question