Explanation:

Box 1: Yes

You can use sensitivity labels to provide protection settings that include encryption of emails and documents to prevent unauthorized people from accessing this data.

Box 2: Yes

You can use sensitivity labels to mark the content when you use Office apps, by adding watermarks, headers, or footers to documents that have the label applied.

Box 3: NO

https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-policy-markings

Explanation:

Box 1: No

Compliance Manager tracks Microsoft managed controls, customer-managed controls, and shared

controls.

Box 2: Yes

Box 3: Yes

Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/compliance-manager?view=o365-worldwide

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/governance/policy/overview

Explanation:

You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

Reference: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Explanation:

Reference:

https://docs.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune

https://docs.microsoft.com/en-us/mem/intune/fundamentals/what-is-device-management

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/bastion/bastion-overview

https://docs.microsoft.com/en-us/azure/bastion/tutorial-create-host-portal