See the explanation below.
Explanation
Step 1: To enable customer-managed keys in the Azure portal, follow these steps:
1. Navigate to your storage account rg1lod10598168n1
2. On the Settings blade for the storage account, click Encryption. Select the Use your own key option, as shown in the following figure.

Step 2: Specify a key from a key vault
To specify a key from a key vault, first make sure that you have a key vault that contains a key. To specify a key from a key vault, follow these steps:
4. Choose the Select from Key Vault option.
5. Choose the key vault KeyVault10598168 containing the key you want to use.
6. Choose the key from the key vault.

Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-encryption-keys-portal

Explanation

Box 1: VNET4 and VNET1 only
RG1 has only Delete lock, while there are no locks on RG4.
RG2 and RG3 both have Read-only locks.
Box 2: VNET4 only
There are no locks on RG4, while the other resource groups have either Delete or Read-only locks.
Note: As an administrator, you may need to lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to CanNotDelete or ReadOnly. In the portal, the locks are called Delete and Read-only respectively.
* CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.
* ReadOnly means authorized users can read a resource, but they can't delete or update the resource.
Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.
Scenario:
User2 is a Security administrator.
Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6.
User2 creates the virtual networks shown in the following table.

Sub1 contains the locks shown in the following table.
References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

See the explanation below.
Explanation
You need to configure the Network Security Group that is associated with subnet0.
* In the Azure portal, type Virtual Networks in the search box, select Virtual Networks from the search results then select VNET1. Alternatively, browse to Virtual Networks in the left navigation pane.
* In the properties of VNET1, click on Subnets. This will display the subnets in VNET1 and the Network Security Group associated to each subnet. Note the name of the Network Security Group associated to Subnet0.
* Type Network Security Groups into the search box and select the Network Security Group associated with Subnet0.
* In the properties of the Network Security Group, click on Inbound Security Rules.
* Click the Add button to add a new rule.
* In the Source field, select Service Tag.
* In the Source Service Tag field, select Internet.
* Leave the Source port ranges and Destination field as the default values (* and All).
* In the Destination port ranges field, enter 7777.
* Change the Protocol to TCP.
* Leave the Action option as Allow.
* Change the Priority to 100.
* Change the Name from the default to something more descriptive such as Allow_TCP_7777_from_Internet.
* Click the Add button to save the new rule.

Microsoft Antimalware is deployed as an extension and not a feature.
Reference:
https://docs.microsoft.com/en-us/azure/security/fundamentals/antimalware