Answer:
1. 2. and (the 2nd) 4.
Step-by-step explanation:
In order to better improve security, a password is always a good start (1, 2).
3 would allow everybody in the company to have all the permissions, if one of these accounts were leaked then somebody could very easily do a lot of damage.
(the 1st) 4 would not be ideal as now nobody would have enough permission to do anything and would limit their usability.
The 2nd 4 is a good idea, as now if the password was input wrong x amount of times, the account is locked. Brute forcing requires attempting to enter a lot of passwords as fast as possible so this directly counters that.
5 would not be ideal as we could allow passwords just as "password" if we have no complexity, these passwords are very quickly checked by brute-forcing programs.