
Explanation:
Box 1: No
Authorization actions are explicitly prohibit in the "NotAction" section.
Box 2: Yes
Azure Resource Manager determines if the action in the API call is included in the roles the user has for this resource. If the roles include Actions that have a wildcard (*), the effective permissions are computed by subtracting the NotActions from the allowed Actions.
Since there are no actions relating to VMs or network interfaces in the "NotAction" section and the user has the wildcard(*) permission for both, it should be possible to deploy VM and set static IP addresses.
Box 3: Yes
Reference:
https://learn.microsoft.com/en-us/azure/role-based-access-control/overview