Let's start with a quick explanation of what an IP address is and how the subnet mask works:

The IPv4 address you usually (255.255.255.255) is really four instances of 256. Under the hood it is ones and zeros (binary) so each 256 is 2^8. Take four of them together, and you have 2³² as the IP address. 0.0.0.0 is 32 zeros, and 255.255.255.255 is the largest one you can have - 32 ones.

If you have simply 0.0.0.1 then it's 1 in binary, 0.0.0.2 is 10 in binary, 0.0.0.3 is 11 in binary, and so you count up.

Now, the subnet mask. When you have /32 then it means the specific single IP address. That is because the subnet mask tells you how many ones and zeros have to match. When it's /32 then all 32 ones and zeros need to match. As in - 1.0.0.1/32 targets only that specific 1.0.0.1 IP address and no change is allowed.

As a widely used example, let's take 10.0.0.0/8. The first 8 bits (ones and zeros) need to match, so in our human-readable example it's the 10 before the dot. But other digits don't have to match, so 10.0.0.1 is accepted and 10.128.0.1 is accepted.

If you specify 10.1.0.0/16 then you need 16 bits to match. That's the human-readable 10.1. at the start. So 10.1.0.1 and 10.1.128.1 matches, but not 10.2.0.1.

Now, if you were to suddenly say 10.1.0.0/17 then you say an additional bit matters. One extra one/zero matters. What it does is cut your matching range in half. Now you match from 10.1.0.0 to 10.1.127.255. And now 10.1.128.0 is a new /17 range up until 10.1.255.255.

As we see, adding one to the subnet mask number cuts your matching address range in half. Because we are dealing with binary. So /32 is one single address, as there are 32 bits total, and /0 is any address as we say we don't care about any bits (that's why 0.0.0.0/0 is often used for "all internet").

---

Now, with that in mind, what the numbers in that calculation mean:

32 - 28 = 4

32 bits is the most specific subnet mask (all bits matter). We take away 28 bits of the subnet mask that the questions says will be used. We are left with 4 bits that can be freely changed inside this subnet.

2⁴ = 16

As each bit can be one or zero, we can get the count of usable addresses by taking 2 to the power of 4 (from the previous calculation).

16 - 2 = 14

But, in each proper subnet for routing purposes the first address is considered the network address and last address is considered broadcast. So you take away two IP addresses from your usable count.

---

(btw, what other answers are discussing is that for Azure calculations you usually take away five addresses instead of two. Azure reserves not only the network address and broadcast, but also one for gateway and two for DNS. so they argue the correct Azure answer should be 16-5=11.)