Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sql/virtual-machines-windows-portal-sql-alwayson-int-listener

A network interface can exist in the same, or different resource group, than the virtual machine you attach it to, or the virtual network you connect it to.
The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, also referred to as a region.
Note, Resource groups can span multiple Regions, but VNets only can hold resources (VMs, Network Adapters) that exists in the same region.
So in this scenario, you need to create VNET1 in any RG and set location as East Asia.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

For Azure AD roles in Privileged Identity Management, only a user who is in the Privileged role administrator or Global administrator role can manage assignments for other administrators. You can grant access to other administrators to manage Privileged Identity Management. Global Administrators, Security Administrators, Global readers, and Security Readers can also view assignments to Azure AD roles in Privileged Identity Management.
Only owner can create an subscription and only global administrator can perform Privileged Identity Management changes. So you can create subscription with external user and then promote him to global administrator to get things done.
As it is mentioned as it is associated with azure tenant so that tenant has an AD domain. So in azure AD the default domain ends with onmicrosoft.com. So you can't have Hotmail IDs there. Moreover always remember the principle of least privileges, when you can get your job done with Global Administrator then you should not look for owner for security purpose.
[email protected] : Correct Choice
As Admin1 is Global Administrator and part of default AD domain so Admin1 can add an Azure AD Privileged Identity Management application to Tenant1
[email protected] : Incorrect Choice
As per the above Admin3 is not Global Administrator, so this option is incorrect.
[email protected] : Incorrect Choice
As per the above Admin2 is not Global Administrator, so this option is incorrect.
[email protected] : Incorrect Choice
Although this user is Global Administrator but referring to the least privileges principal and default domain consideration this option is incorrect.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance

Rule 2 is blocking HTTPS access (port 443) and has a priority of 500.
Changing Rule 3 (ports 60-500) and giving it a lower priority number will allow access on port 443.
Note: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops.
Incorrect Answers:
A: HTTPS uses port 443. Rule6 only applies to ports 150 to 300.
C, D: Rule 1 blocks access to port 80, which is used for HTTP, not HTTPS.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview