Explanation
A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of data, or configuration information for virtual machines (VMs), workloads, servers, or workstations. You can use Recovery Services vaults to hold backup data for various Azure services References: https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replication

Explanation:
Box 1: VM1 only
VM1 is in the same region as Vault1.
File1 is not in the same region as Vautl1.
SQL is not in the same region as Vault1.
Blobs cannot be backup up to service vaults.
Note: To create a vault to protect virtual machines, the vault must be in the same region as the virtual machines.
Box 2: Share1 only.
Storage1 is in the same region (West USA) as Vault2. Share1 is in Storage1.
Note: After you select Backup, the Backup pane opens and prompts you to select a storage account from a list of discovered supported storage accounts. They're either associated with this vault or present in the same region as the vault, but not yet associated to any Recovery Services vault.
References:
https://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault
https://docs.microsoft.com/en-us/azure/backup/backup-afs

Explanation

Box 1: User1 and User3 only.
The Owner Role lets you manage everything, including access to resources.
The Network Contributor role lets you manage networks, but not access to them.
Box 2: User1 and User2 only
The Security Admin role: In Security Center only: Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations.
References:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

the multi-factor authentication service settings - Correct choice
There are two criterias mentioned in the question.
1. MFA required
2. Access from only a specific geographic region/IP range.
To satisfy both the requirements you need MFA with location conditional access. Please note to achieve this configuration you need to have AD Premium account for Conditional Access policy.
Navigate to Active Directory --> Security --> Conditional Access --> Named Location. Here you can create a policy with location (on-premise IP range) and enable MFA. This will satisfy the requirements.

an Azure AD Identity Protection user risk policy - Incorrect choice
In the Identity Protection, there are three (3) protection policies- User Risk, Sign-In Risk & MFA Registration. None of those in which you can enable a location (on-prem IP Range) requirement in any blade.
the default for all the roles in Azure AD Privileged Identity Management - Incorrect choice
This option will not help you to restrict the users to access only form on prem.
an Azure AD Identity Protection sign-in risk policy - Incorrect choice
In the Identity Protection, there are three (3) protection policies- User Risk, Sign-In Risk & MFA Registration. None of those in which you can enable a location (on-prem IP Range) requirement in any blade.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Explanation
A managed identity from Azure Active Directory allows your app to easily access other AAD-protected resources such as Azure Key Vault. The identity is managed by the Azure platform and does not require you to provision or rotate any secrets.
User assigned managed identities can be used on Virtual Machines and Virtual Machine Scale Sets.
References:
https://docs.microsoft.com/en-us/azure/app-service/app-service-managed-service-identity