
Explanation

Box 1: 2
You don't need to verify Sub1.contoso.onmicrosoft.com because the onmicrosoft.com domain and DNS is managed by Microsoft. You also don't need to configure an MX record for Sub1.contoso.onmicrosoft.com because that will be done by Microsoft.
For sub2.contoso.com, you don't need to verify the domain because you have already verified its parent domain contoso.com. However, you do need an MX record to direct email for that domain to Exchange Online.
For Fabrikam.com, you will need to verify the domain. You will need an MX record to direct email for that domain to Exchange Online.
Box 2: 0
You 'should' create CNAME records for autodiscover to point your email clients to Exchange Online to connect to the mailboxes. However, you don't have to. You could configure the email client manually.
Therefore, the minimum number of CNAME records required is zero.