
Explanation:
Box 1: Network Contributor on RG1
For creating a backend pool we need permission to access VNet on RG.
Box 2: Network Contributor on RG1
For creating a health probe we need to have permission for deployment on Resource Group.
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider- operations#microsoftnetwork