Is attaching Network Security Group to the subnet level is fine or do we need to create NSG for a VM resource is better?

If I enable Azure DDoS Network Protection for a Vnet01, whether the protection will be applicable for the resources connected to the Vnet01?

Why it is better to keep accelerated networking enabled for Virtual machines?

If I want to isolate web servers from database servers, what Virtual Network component should we use?

If there is a private endpoint between a VM and an Azure SQL Database, should place both the resources in the same Vnet? or can I have them in the different vnet and different region? How to design the correct architecture and what are the scope of project that we need to collect from the client for the better understanding?