You have the resources shown in the following table.

You need to protect the virtual machines by using Azure DDoS Network Protection plans.
What is the minimum number of DDoS Network Protection plans you should deploy?
You have the resources shown in the following table.
You need to protect the virtual machines by using Azure DDoS Network Protection plans.
What is the minimum number of DDoS Network Protection plans you should deploy?
For DDoS Network Protection, under a tenant, a single DDoS protection plan can be used across multiple subscriptions, so there's no need to create more than one DDoS protection plan. For DDoS IP Protection, there's no need to create a DDoS protection plan. Customers can enable DDoS IP protection on any public IP resource. https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview
Should be 1
No sure why the answer is showing up as more than one, but it will be just 1 per subscription.
A - 1 - we have 1 tenant, meaning one DDoS plan. These plans can also span multiple subscription and in our case, all subs are in Tenant1.