https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-sql

Explanation

Box 1: Yes
User1 is member of Group1. Sign in from unfamiliar location is risk level Medium.
Box 2: Yes
User2 is member of Group1. Sign in from anonymous IP address is risk level Medium.
Box 3: No
Sign-ins from IP addresses with suspicious activity is low.
Note:

Azure AD Identity protection can detect six types of suspicious sign-in activities:
* Users with leaked credentials
* Sign-ins from anonymous IP addresses
* Impossible travel to atypical locations
* Sign-ins from infected devices
* Sign-ins from IP addresses with suspicious activity
* Sign-ins from unfamiliar locations
These six types of events are categorized in to 3 levels of risks - High, Medium & Low:
References:
http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

Check below steps in explanation for Task.
Explanation
To register App28681041 to Azure AD and generate a password for it, you can follow these steps:
In the Azure portal, search for and select Azure Active Directory.
In the left pane, select App registrations.
Select New registration.
In the Register an application pane, enter the following information:
Name: App28681041
Supported account types: Select the appropriate account types for your scenario.
Redirect URI: Leave this field blank.
Select Register.
In the App registrations pane, select the newly created App28681041 application.
In the left pane, select Certificates & secrets.
Select New client secret.
In the Add a client secret pane, enter the following information:
Description: Enter a description for the client secret.
Expires: Select an appropriate expiration date for the client secret.
Select Add.
In the Certificates & secrets pane, copy the value of the newly created client secret.
You can find more information on this topic in the following Microsoft documentation: Quickstart: Register an application with the Microsoft identity platform.

Explanation:
NSGs: 1
Network security rules: 3
Not 2: You cannot specify multiple service tags or application groups) in a security rule.
References:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Reference:
https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking