Explanation:
No
subnet1(WM1->NSG1 outbound->NSG10 outbound)->subnet2(NSG1 inbound->NSG11 inbound->VM2) Yes NSG10 blocks ICMP from VNet4 (source 10.10.0.0/16) but it is not blocked from VM2#'s subnet (VNet1/Subnet2).
No
NSG11 blocks RDP (port TCP 3389) destined for "~VirtualNetwork". VirtualNetwork is a service tag and means the address space of the virtual network (VNet1) which in this case is 10.1.0.0/16. Therefore, RDP traffic from subnet2 to anywhere else in VNet1 is blocked.