Box 1: Yes -
The Contoso location is included in the policy and MFA is required.
Box 2: No -
The policy applies to the Azure portal and Azure management endpoints. The policy does not apply to web services host in Azure.
Box 3: No -
The policy applies only to users in the Contoso location. The policy does not apply to users external to the Contoso location.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition