Explanation:
Box 1: Azure Web Application Firewall (WAF)
Inbound connections to App1 that contain security threats specified in the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP) must be blocked.
The Azure Web Application Firewall (WAF) on Azure Application Gateway actively safeguards your web applications against common exploits and vulnerabilities. As web applications become more frequent targets for malicious attacks, these attacks often exploit well-known vulnerabilities such as SQL injection and cross-site scripting.
WAF on Application Gateway is based on the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP).
Box 2: Azure Firewall
Outbound HTTP and HTTPS connections from the virtual machine scale set that contain security threats identified by the Microsoft Defender Threat Intelligence (Defender TI) feed must be blocked.
Azure Firewall threat intelligence-based filtering
You can enable Threat intelligence-based filtering for your firewall to alert and deny traffic from/to known malicious IP addresses, FQDNs, and URLs. The IP addresses, domains and URLs are sourced from the Microsoft Threat Intelligence feed, which includes multiple sources including the Microsoft Cyber Security team. Intelligent Security Graph powers Microsoft threat intelligence and uses multiple services including Microsoft Defender for Cloud.
Reference:
https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview
https://learn.microsoft.com/en-us/azure/firewall/threat-intel

Explanation:
Box 1: Automation rules
You can respond to threats by using playbooks with automation rules in Microsoft Sentinel Box 2: Incident Use triggers and actions in Microsoft Sentinel playbooks For most use cases, incident-triggered automation is the preferable approach. In Microsoft Sentinel, an incident is a "case file" ?an aggregation of all the relevant evidence for a specific investigation. It's a container for alerts, entities, comments, collaboration, and other artifacts.
Unlike alerts which are single pieces of evidence, incidents are modifiable, have the most updated status, and can be enriched with comments, tags, and bookmarks. The incident allows you to track the attack story which keeps evolving with the addition of new alerts.
For these reasons, it makes more sense to build your automation around incidents. So the most appropriate way to create playbooks is to base them on the Microsoft Sentinel incident trigger in Azure Logic Apps.
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation- rules
https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

This question is to increase secure score. Here is a long reference page from Microsoft of security recommendations that can increase your secure score. Sentinel & PIM are not on it. The explanation makes a great point about alerts not being preventive, which is a key aspect of the required solution.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference

Explanation:
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls