Explanation

Box 1: No
Azure firewall does not encrypt network traffic. It is used to block or allow traffic based on source/destination IP address, source/destination ports and protocol.
Box 2: No
A network security group does not encrypt network traffic. It works in a similar way to a firewall in that it is used to block or allow traffic based on source/destination IP address, source/destination ports and protocol.
Box 3: No
The question is rather vague as it would depend on the configuration of the host on the Internet. Windows Server does come with a VPN client and it also supports other encryption methods such IPSec encryption or SSL/TLS so it could encrypt the traffic if the Internet host was configured to require or accept the encryption.
However, the VM could not encrypt the traffic to an Internet host that is not configured to require the encryption.
References:
https://docs.microsoft.com/en-us/azure/security/azure-security-data-encryption-best-practices#protect-data-in-tra

Explanation

.

Explanation

Azure AD join only applies to Windows 10 devices.
References:
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy
https://docs.microsoft.com/en-us/azure/active-directory/devices/azureadjoin-plan

Explanation

Reference:
https://docs.microsoft.com/en-us/azure/china/overview-operations
https://docs.microsoft.com/en-us/azure/azure-government/documentation-government-welcome

Explanation:
Box 1: Yes
With Azure ExpressRoute, all inbound data transfer is free of charge.
Box 2: No
Inbound data traffic is free but outbound data traffic is not.
Box 3: Yes
References:
https://azure.microsoft.com/en-us/pricing/details/expressroute/
https://azure.microsoft.com/en-us/pricing/details/bandwidth/