Explanation:
Box 1: 3
One app per child domain. We have three child domains.
Box 2: 2
Two for each disjoint forest. We have one forest.
Note: Microsoft Entra, Microsoft Entra ID, App provisioning, Cloud HR application to Microsoft Entra user provisioning Scenario: Single cloud HR app tenant -> target multiple child domains in a disjoint Active Directory forest

This scenario involves provisioning users from the cloud HR app to domains in disjoint Active Directory forests.
We recommend the following production configuration:
* Number of Microsoft Entra Connect provisioning agents to deploy on-premises Two per disjoint Active Directory forest.
* Number of provisioning connector apps to configure
One app per child domain.
Reference:
https://learn.microsoft.com/en-us/entra/identity/app-provisioning/plan-cloud-hr-provision