Explanation:
Box 1: A deployment group
When authoring an Azure Pipelines or TFS Release pipeline, you can specify the deployment targets for a job using a deployment group.
If the target machines are Azure VMs, you can quickly and easily prepare them by installing the Azure Pipelines Agent Azure VM extension on each of the VMs, or by using the Azure Resource Group Deployment task in your release pipeline to create a deployment group dynamically.
Box 2: A deployment group
References:
https://docs.microsoft.com/en-us/azure/devops/pipelines/release/deployment-groups

During evaluation of existing resources, resources that match a deny policy definition are marked as non-compliant.
https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects#denytraffic.

Use Azure SQLDatabase Deployment task in a build or release pipeline to deploy to Azure SQL DB using a DACPAC or run scripts using SQLCMD.
Reference:
https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/sql-azure-dacpac-deployment

Explanation:
Box 1: Microsoft-hosted agents
Each job in a pipeline must run on a new virtual machine.
The virtual machines must run the latest version of Windows.
If your pipelines are in Azure Pipelines, you can conveniently run your jobs by using a Microsoft- hosted agent. With Microsoft-hosted agents, maintenance and upgrades happen automatically.
You always have the latest version of the VM image you specify in your pipeline. Each time you run a pipeline, you get a fresh virtual machine for each job in the pipeline. The virtual machine is discarded after one job. Any change that a job makes to the virtual machine file system, such as checking out code, is unavailable on the next job.
Box 2: Managed DevOps Pool agents
Deployment jobs must run in a customized virtual machine image
Each agent requires 512 GB of storage
Use Managed DevOps Pool agents when you need the infrastructure managed by Microsoft but require custom network access to private Azure resources, custom VM images for specialized software, or a simpler, scalable alternative to self-hosted agents. This service is ideal if your CI/CD pipelines need to interact with your virtual network, private endpoints, or if you want to leverage custom images without the overhead of managing VMs yourself.
Box 3: Azure Virtual Machine Scale Set agents
Load testing must be performed concurrently across 2,000 hosts.
Deployment jobs must run across multiple customized virtual machine images.
Use Azure Virtual Machine Scale Set (VMSS) agents for Azure DevOps pipelines when you need autoscale-enabled self-hosted agents to handle variable workloads, particularly when you want to save costs by scaling down to zero idle agents. VMSS agents are ideal for scenarios requiring custom software installations, access to protected resources, or when dealing with high demand from multiple parallel CI/CD jobs.
Reference:
https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted
https://learn.microsoft.com/en-us/azure/devops/managed-devops-pools/overview?view=azure- devops
https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/scale-set-agents?view=azure- devops