Explanation:
Yes
NO
NO

Explanation:

Box 1: No
Building a data center infrastructure is capital expenditure, not operation expenditure.
Box 2: Yes
OpEx is ongoing costs (costs of operations) such as staff salaries.
Box 2: Yes
OpEx is ongoing costs (costs of operations) such as leasing software. If you purchased software as a one-off purchase, that would be CapEx, but leasing software is ongoing so it's OpEx.

https://blog.pragmaticworks.com/what-is-azure-advisor#:~:text=Microsoft%20defines%20Azure%
20Advisor%20as,solutions%20based%20on%20that%20data.

You can restrict traffic to multiple virtual networks in multiple subscriptions with a single Azure firewall.
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.
You can centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Azure Firewall uses a static public IP address for your virtual network resources allowing outside firewalls to identify traffic originating from your virtual network.
https://docs.microsoft.com/en-us/azure/firewall/overview