Explanation:
Box 1: No
Azure Bastion requires a dedicated subnet: AzureBastionSubnet.
You must create this subnet in the same virtual network that you want to deploy Azure Bastion to.
The subnet must have the following configuration:
Subnet name must be AzureBastionSubnet.
Subnet size must be /26 or larger.
https://learn.microsoft.com/en-us/azure/bastion/configuration-settings#subnet Box 2: Yes With /25 we have more than 100 IP's left to use.
Should not be a problem to deploy 100 additional VM's with a single IP.
Box 3: No
You can not change the IP address range of subnet3-1 range to 10.3.1.0/16.
Azure will give this error '10.3.1.0/16 is not a valid CIDR block' because its higher than the Vnet's IP address space of 10.3.0.0/16

Explanation:
Box 1: No
VM1, which is hosting site1.contoso.com, is located in East US. The VM1 endpoint status is degraded. Endpoint monitoring health checks are failing. The endpoint isn't included in DNS responses and doesn't receive traffic.
When an endpoint has a Degraded status, it's no longer returned in response to DNS queries.
Instead, an alternative endpoint is chosen and returned. The traffic- routing method configured in the profile determines how the alternative endpoint is chosen.
Priority. Endpoints form a prioritized list. The first available endpoint on the list is always returned.
If an endpoint status is Degraded, then the next available endpoint is returned.
The user will connect to site2.us.contoso.com instead.
Box 2: No
VM3, which is hosting site2.contoso.com, is located in in East US. The VM3 endpoint status is CheckingEndpoint. The endpoint is monitored, but the results of the first probe haven't been received yet. CheckingEndpoint is a temporary state that usually occurs immediately after adding or enabling an endpoint in the profile. An endpoint in this state is included in DNS responses and can receive traffic.
User will connect to site2.contoso.com, not to site2.uk.contoso.com
Box 3: No
VM3, which is hosting site2.contoso.com, is located in in East US. The VM1 endpoint status is CheckingEndpoint, which is OK (see above).
User will connect to site2.contoso.com, not to site2.japan.contoso.com
Reference:
https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-monitoring

The first step is to create the AzureFirewallSubnet in VNet1 to meet the prerequisites for deploying Azure Firewall.

Explanation:
To establish the private link service you need a load balancer in VNet 1 and for sure the private link service resource. In the partner company tenant you need an private endpoint that connects to this private link service. To answer the question correctly we might answer to create standard load balancer and private link service in vnet1 an pe in vnet2.
https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview#workflow