The correct options are Permit traffic from designated public IP addresses or IP ranges and Grant access to selected Azure virtual networks and subnets.

The Permit traffic from designated public IP addresses or IP ranges choice is valid because Azure Storage firewalls support IP network rules. You can list specific public IP addresses or CIDR ranges to allow only those sources to reach the storage account while blocking other public traffic.

The Grant access to selected Azure virtual networks and subnets choice is valid because you can create virtual network rules or use private endpoints to allow traffic from particular virtual networks and subnets. This lets you restrict access to resources that reside inside specified VNets and subnets rather than allowing broad public access.

Whitelist resource group names is incorrect because resource groups are a management construct and are not a network source. Firewall rules for storage evaluate network addresses and virtual network identities, not the name of a resource group.

Set the firewall to allow all networks is incorrect because that setting removes network restrictions and does not limit access to specific sources. Allowing all networks is the opposite of restricting access to particular IPs or virtual networks.

Full AWS Practitioner Certification Question