Don't we get a hit for the tag 0x2?
No. The two entries in the TLB with the tag 02 are for completely different Virtual Page Numbers (VPNs). Even if they share the same tag, they are not for VPN 8. The one in Set 1 is for VPN 9 and the one in Set 3 is for VPN 0b (which happens to be invalid). When looking up VPN 8, only Set 0 will be searched, because it is known that VPN 8 can only be in Set 0.
Just because TLB Entries share the same tag does not mean that they are for the same VPN. Since the TLB is not fully associative, the individual TLB entries do not have to contain the entire VPN, because part of the VPN is implied by the set in which the entry is stored. Only with a fully associative TLB would it be necessary to store the entire VPN into every TLB entry.
Therefore, the VPN is split into the TLB Tag and the TLB Index. In your exercise, the TLB Index consists of the two least significant bits of the VPN and the TLB Tag consists of the remaining bits. Only the TLB Tag is stored in every TLB Entry, the TLB Index is not stored, as it is implied by the Set in which the TLB Entry resides.