Explanation:

Box 1: user_impersonation
Box 2: delegated
Example:
1.Select the API permissions section
2.Click the Add a permission button and then:
Ensure that the My APIs tab is selected
3.In the list of APIs, select the API TodoListService-aspnetcore.
4.In the Delegated permissions section, ensure that the right permissions are checked: user_impersonation.
5.Select the Add permissions button.
Box 3: delegated
Example
1.Select the API permissions section
2.Click the Add a permission button and then,
Ensure that the Microsoft APIs tab is selected
3.In the Commonly used Microsoft APIs section, click on Microsoft Graph
4.In the Delegated permissions section, ensure that the right permissions are checked: User.Read. Use the search box if necessary.
5.Select the Add permissions button
References:
https://docs.microsoft.com/en-us/samples/azure-samples/active-directory-dotnet-webapp-webapi- openidconnect-aspnetcore/calling-a-web-api-in-an-aspnet-core-web-application-using-azure-ad/

A queue allows processing of a message by a single consumer. Need a CloudQueueClient to access the Azure VM.
Reference:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-queues-topics-subscriptions

The correct answer is A, B, and C. To inspect request processing of the APIs in APIM, you need to do the following three actions:
Enable the Allow tracing setting for the subscription used to inspect the API. This setting allows you to trace request processing in APIM using the test console, a REST client, or a client app. You can enable this setting in the portal by selecting Subscriptions and then selecting the subscription you want to use for debugging1.
Add the Ocp-Apim-Trace header value to the API call with a value set to true. This header triggers tracing when making requests to APIM using a REST client or a client app. You also need to add the Ocp-Apim- Subscription-Key header value to the key for a subscription that allows access to the API1.
Add the Ocp-Apim-Subscription-Key header value to the key for a subscription that allows access to the API.
This header authenticates your request and grants you access to the API. You can find the key for your subscription in the portal by selecting Subscriptions and then selecting Show/hide keys1.
You do not need to create and configure a custom policy for tracing request processing. The trace policy is used to add a custom trace into the request tracing output, Application Insights telemetries, and/or resource logs2. It is not required for inspecting the APIs.

In the Dynamic Data Masking configuration page, you may see some database columns that the recommendations engine has flagged for masking. In order to accept the recommendations, just click Add Mask for one or more columns and a mask is created based on the default type for this column. You can change the masking function by clicking on the masking rule and editing the masking field format to a different format of your choice.

References:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-dynamic-data-masking-get-started-portal