Server-level firewall is the correct option for every Azure SQL database.

Server-level firewall is the platform provided access control that is active by default for Azure SQL servers and their databases. Administrators must create server or database firewall rules to allow client IP addresses or enable the built in option to allow Azure services to connect. The firewall blocks incoming connections until appropriate rules are added so it acts as the default network level control for the service.

Azure Firewall is a separate managed network firewall service that you must deploy and configure and it is not automatically applied to each Azure SQL database.

Network security group filters traffic at the subnet or network interface level within a virtual network and it does not serve as the platform default access control for the PaaS Azure SQL endpoint.

Cloud Armor is a Google Cloud product for DDoS and web application protection and it is not relevant to Azure services and it is not used as a default control for Azure SQL.

Full AWS Practitioner Certification Question