https://azure.microsoft.com/en-us/pricing/details/ddos-protection/

https://www.keytos.io/docs/azure-pki/azure-certificate-management/how-to-issue-tls-certificates-for-azure-firewall/

Explanation:
To enable NSG flow logs, you should enable Network Watcher in the region where your VMs are deployed. Network Watcher provides tools to monitor and collect metrics and logs from your Azure resources deployed inside a Virtual Network. Currently, Network Watcher only supports IaaS (Infrastructure as a Service) and is not intended to be used with PaaS (Platform as a Service) resources.
You should register the Microsoft.Insights provider. NSG flow logs use Azure Monitor internally to collect the logs and metrics. You should enable the Microsoft.Insights provider for the subscription where the resources are deployed.
To store the flow logs, you should create a storage account. This storage account should be in the same region and all the logs collected from NSG will be shipped to the storage account. The logs are stored in JSON format and can be viewed by downloading the files locally or shipping the files to a Security Information and Event Management system (SIEM) or an Intrusion Detection System (IDS).
You should also enable NSG flow logs. Once the flow logs are enabled, you can go and check the logs in the insights-logs-networksecuritygroupflowevent container in your storage account. In the container, navigate the folder hierarchy to find the JSON file. It follows the following naming convention for the folder hierarchy:
https://{storageAccountName}.blob.core.windows.net/insights-logs-networksecuritygroupflowevent/resourceId=/SUBSCRIPTIONS/{subscriptionID}/RESOURCEGR OUPS/{resourceGroupName}/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGR OUPS/{nsgName}/y={year}/m={month}/d={day}/h={hour}/m=00/macAddress={macAddress}/PT1
H.json
You should not create a Log Analytics workspace. There is another Azure service called Azure Traffic Analytics that uses Network Watcher NSG flow logs from Log Analytics to provide insights on the traffic flow. NSG flow logs can be simultaneously shipped to Log Analytics and a storage account.
You should not register the Microsoft.SecurityInsights provider. This provider is used by Microsoft Sentinel (formerly, Azure Sentinel), which is a cloud-based SIEM managed by Azure.

Explanation:
Box 1: No
All outbound traffic from VM2 is sent to the internet by default.
Box 2: No
The effective route table show the all the the subnet on the same VNET as a more specific one than the default route and Gateway routes. So subnets within a vnet can communicate can communicate directly.
Box 3: Yes
All outbound traffic from VM1 is sent to the VPN gateway.
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm