Explanation

Box 1: Yes.
User1 can request access to App1 because "Allow users to request access to this application" is set to Yes.
Box 2: No.
User2 is an approver. If User2 requests access to App1, he will still need to approve the request before he is added to Group1.
Box 3: Yes.
User2 can approve requests for App1 because "Who is allowed to approve access to this application" is set to User2.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-self-service-access

Explanation
Graphical user interface, text, application Description automatically generated

The answer to this question depends on whether User1 and User2 have been added as guests. The question does not say that they are guests so we would have to assume they're not.
External Access is turned off. Even with the Contoso.com domain added as an allowed domain, the Off settings override this. If the external access settings were 'On', they would be on for only the Contoso.com domain.
Box 1: No
If External Access was On, the answer to this would still be No. If User2 was a guest, the answer to this would be Yes.
Box 2: No
If External Access was On, the answer to this would still be No. External Access does not enable Meet Now for the external user. If User1 was a guest, the answer to this would be Yes.
Box 3: No
If External Access was On, the answer to this would still be No. External Access does not allow blocking. If User1 was a guest, the answer to this would be Yes.
Reference:
https://docs.microsoft.com/en-us/microsoftteams/set-up-guests
https://docs.microsoft.com/en-us/microsoftteams/communicate-with-users-from-other-organizations

Explanation
You need to add an exception. In the Advanced Settings of the DLP policy, you can add a rule to configure the Conditions and Actions. There is also an 'Add Exception' button. This gives you several options that you can select as the exception. One of the options is 'except when recipient domain is'. You need to select that option and enter the domain name contoso.com.
Reference:
https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies#how-dlp-policies-w

Explanation

Group Writeback is enabled in the Azure AD Connect configuration so groups created in Azure Active Directory will be synchronized to the on-premise Active Directory. A security group created in Azure Active Directory will be synchronized to the on-premise Active Directory as a security group.
Device Writeback is enabled in the Azure AD Connect configuration so computers joined to the Azure Active Directory will be synchronized to the on-premise Active Directory. They will sync to the RegisteredDevices container in the on-premise Active Directory.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-device-writeback