Explanation:
Box 1: VNET4 and VNET1 only
RG1 has only Delete lock, while there are no locks on RG4.
RG2 and RG3 both have Read-only locks.
Box 2: VNET4 only
There are no locks on RG4, while the other resource groups have either Delete or Read-only locks.
Note: As an administrator, you may need to lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to CanNotDelete or ReadOnly. In the portal, the locks are called Delete and Read-only respectively.
* CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.
* ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.
Scenario:
User2 is a Security administrator.
Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6.
User2 creates the virtual networks shown in the following table.

Sub1 contains the locks shown in the following table.

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

Microsoft Antimalware is deployed as an extension and not a feature.
Reference:
https://docs.microsoft.com/en-us/azure/security/fundamentals/antimalware

Explanation

Step 1: Create an access review program
Step 2: Create an access review control
Step 3: Set Reviewers to Group owners
In the Reviewers section, select either one or more people to review all the users in scope. Or you can select to have the members review their own access. If the resource is a group, you can ask the group owners to review.

References:
https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review
https://docs.microsoft.com/en-us/azure/active-directory/governance/manage-programs-controls

Explanation:
Box 1: User1, User2, User3, User4
Contains "ON" is true for Montreal (User1), MONTREAL (User2), London (User 3), and Ontario (User4) as string and regex operations are not case sensitive.
Box 2: Only User3
Match "*on" is only true for London (User3).
Scenario:
Contoso.com contains the users shown in the following table.

Contoso.com contains the security groups shown in the following table.

References:
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership

See the explanation below.
Explanation
To add an Azure firewall to a VNET, the VNET must first be configured with a subnet named AzureFirewallSubnet (if it doesn't already exist).
Configure VNET3.
* In the Azure portal, type Virtual Networks in the search box, select Virtual Networks from the search results then select VNET3. Alternatively, browse to Virtual Networks in the left navigation pane.
* In the Overview section, note the Location (region) and Resource Group of the virtual network. We'll need these when we add the firewall.
* Click on Subnets.
* Click on + Subnet to add a new subnet.
* Enter AzureFirewallSubnet in the Name box. The subnet must be named AzureFirewallSubnet.
* Enter an appropriate IP range for the subnet in the Address range box.
* Click the OK button to create the subnet.
Add the Azure Firewall.
* In the settings of VNET3 click on Firewall.
* Click the Click here to add a new firewall link.
* The Resource group will default to the VNET3 resource group. Leave this default.
* Enter a name for the firewall in the Name box.
* In the Region box, select the same region as VNET3.
* In the Public IP address box, select an available public IP address if one exists, or click Add new to add
* a new public IP address.
* Click the Review + create button.
* Review the settings and click the Create button to create the firewall.
Reference:
https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal