Explanation:

Box 2: One NSG
The minimum requirement is one NSG. You could attach the NSG to VMScaleSet1 and restrict outbound traffic, or you could attach the NSG to VMScaleSet2 and restrict inbound traffic. Either way you would need two custom NSG rules.
Box 1: Two custom rules
With the NSG attached to VMScaleSet2, you would need to create a custom rule blocking all traffic from VMScaleSet1. Then you would need to create another custom rule with a higher priority than the first rule that allows traffic on port 443.
The default rules in the NSG will allow all other traffic to VMScaleSet2.

Explanation:

Explanation:

Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/ipv6-overview
https://docs.microsoft.com/en-us/azure/virtual-network/ipv6-add-to-existing-vnet-powershell
1) Correct: /64
Explanation: The subnets for IPv6 must be exactly /64 in size. This ensures future compatibility should you decide to enable routing of the subnet to an on-premises network since some routers can only accept /64 IPv6 routes.
Source: https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview
2) Correct: Public IPv6 Address
Explanation: Add IPv6 configuration to NIC. "Configure all of the VM NICs with an IPv6 address using Add- AzNetworkInterfaceIpConfig" Source: https://docs.microsoft.com/en-us/azure/load-balancer/ipv6-add-to-existing-vnet-powershell