When users map an Azure file share (hosted in Azure Files) to their Windows 10 devices using SMB (Server Message Block) protocol, the connection uses TCP port 445 for communication.
According to the official Microsoft Azure Files documentation ("Port requirements for Azure file shares" and
"Use an Azure file share with Windows"), the SMB protocol version 3.0 is used for secure, encrypted communication between the client and the Azure Files service. SMB communicates over TCP port 445, which must be open outbound from the client system to the Azure Storage endpoint (for example, contosostorage.
file.core.windows.net).
Here's how Azure handles access:
* SMB over TCP port 445 is used for file shares (for mounting and drive mapping).
* HTTPS (port 443) is used for REST API and portal access to the storage account.
* Port 80 is optional (used only for unencrypted HTTP requests, not supported for SMB access).
* Port 3389 is for Remote Desktop Protocol (RDP), unrelated to Azure Files.
Therefore, to allow users to map the Azure Files share (\contosostorage.file.core.windows.net\data) from their home computers, TCP port 445 must be open on outbound connections.

According to the Microsoft documentation, Azure Bastion is a service that provides more secure and seamless RDP and SSH access to virtual machines without any exposure through public IP addresses. You can provision the service directly in your local or peered virtual network to get support for all the VMs within it.
In your scenario, you have three virtual networks that are peered with each other. This means that they can communicate with each other as if they were in the same virtual network. Therefore, you can deploy one Bastion host in any of the virtual networks and use it to connect to all the virtual machines in the peered virtual networks. You don't need to deploy a separate Bastion host for each virtual network or each virtual machine.
For more information about how to deploy and use Azure Bastion, see Tutorial: Deploy Bastion using specified settings: Azure portal.

Explanation:

Box 1: Sub1, RG1, and VM1 only
You can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources.
Box 2: Sub1, RG1, and VM1 only
You apply tags to your Azure resources, resource groups, and subscriptions.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json

Explanation:
Perform all actions on a virtual network:
"Microsoft.Network/virtualNetworks/*"
View the configuration data of a storage account:
"Microsoft.Storage/StorageAccounts/read"
To perform all actions on a virtual network, you need to use the wildcard () character in the action string, which grants access to all actions that match the string. The action string for virtual networks is "Microsoft.
Network/virtualNetworks/". To view the configuration data of a storage account, you need to use the read action substring in the action string, which enables read actions (GET). The action string for storage accounts is "Microsoft.Storage/StorageAccounts/read". References:
https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles