Explanation

Box 1: Yes
There are different replication options available with a storage account. The 'minimum' replication option is Locally Redundant Storage (LRS). With LRS, data is replicated synchronously three times within the primary region.
Box 2: No
Data is not backed up automatically to another Azure Data Center although it can be depending on the replication option configured for the account. Locally Redundant Storage (LRS) is the default which maintains three copies of the data in the data center.
Geo-redundant storage (GRS) has cross-regional replication to protect against regional outages. Data is replicated synchronously three times in the primary region, then replicated asynchronously to the secondary region.
Box 3: No
The limits are much higher than that. The current storage limit is 2 PB for US and Europe, and 500 TB for all other regions (including the UK) with no limit on the number of files.
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview

Explanation:
Box 1: Yes
An Azure free account has a spending limit. This is currently 200 USD or 150 GBP.
Box 2: No
Azure free account has a 5 GB blob storage limit and a 5 GB file storage limit.
Box 3: No
Azure free account has a limit of 10 web, mobile or API apps
References:
https://azure.microsoft.com/en-us/free/
https://azure.microsoft.com/en-us/free/free-account-faq/
https://docs.microsoft.com/en-us/azure/billing/billing-avoid-charges-free-account
https://azure.microsoft.com/en-us/free/free-account-faq/
https://docs.microsoft.com/en-us/azure/billing/billing-avoid-charges-free-account

Explanation
Azure AD Identity Protection includes two risk policies: sign-in risk policy and user risk policy. A sign-in risk represents the probability that a given authentication request isn't authorized by the identity owner.
There are several types of risk detection. One of them is Anonymous IP Address. This risk detection type indicates sign-ins from an anonymous IP address (for example, Tor browser or anonymous VPN). These IP addresses are typically used by actors who want to hide their login telemetry (IP address, location, device, etc.) for potentially malicious intent.
You can configure the sign-in risk policy to require that users change their password.
References:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy

Explanation
Azure virtual machine = Infrastructure as a service (IaaS)
Azure SQL databases = Platform as a service (PaaS)