Could have been a good question, but seems to have got a bit muddled somehow. The muddle is a pity, as there is at least one important lesson buried in there.
As Rune Bivrin pointed, 0 isn't actually a possible result from such a query. In addition, without even attempting to evaluate the where clause it is obvious that the first option isn't a possible result from such a query, because it is a set of one column rows and the query selects two columns, not one. So the only answer which isn't ruled out by elementary logic is the third answer, but the third answer is wrong because the SQL syntax is fine and there's nothing there that could cause an error to be raised. I guess the majority of people (58% or reponses to date) understand 3-valued logic and correctly worked out that the query would return no rows if the logic conformed to the 3-value logic rules as specified in the ANSI and ISO standards and assumed that "0" meant not a row containg "0" but "0 rows"; that's how I came to pick 0 as the answer, but it's not really satisfactory to be forced to guess what the option was intended to be in order to guess which anser will be considered correct, but option 2 is perhaps the "least wrong" answer - certainly if ANSI ULLs is ON.
Even worse, if the errors in options 1 and 2 were fixed the only correct answer would still be "it depends": if ANSI NULLS are OFF, the first answer is nearer to correct than the second one, because it then returns the correct number of rows, and the correct firstnames; so even if the first anser were corrected to show both columns, and the second one corrected to say "0 rows", the question would be ambiguous because which of those two answers was correct would depend on whether ANSI NULLs was set ON or OFF.
Finally, I reckon there could be a case for assuming that since options 1 and 2 don't say what they mean neither does option 3: it doesn't mean that SQL Server would return an error, it means that the person who wrote the query committed an error in using a NOT IN clause when the domain of the elements of the set did not preclude nulls; in my opinion that's not 100% justifiable, because we don't know how the query is used, we don't have the context, and there may be a context in which getting no rows when there is at least one null creates no problem because the result required is the set of rows which are known not to match, but that's just my opinion and I don't think it unreasonable for people to take the opposite view. So there's a plausible argument that the third option is just as correct as the second (assuming ANSI NULL is on).
What's the buried lesson? That people need to understand how three-valued logic works, understand how the result of tests involving NULL can be a bit startling if you try to think in terms of two-valued logic, and understand how to write queries that will do what they expect in an environment with NULLs, unless they are able to design their data in such a way that every column in every table has a NOT NULL constraint.