Apply an IP address allow list using an IP firewall policy is correct because Cosmos DB provides account level IP firewall rules that let you permit only specified IPv4 addresses or ranges to reach the account over the public internet.

An IP firewall policy is configured at the Cosmos DB account level and can be managed from the Azure portal, Azure CLI, PowerShell, or ARM templates. This feature enforces network level access based on source IP addresses and is the appropriate mechanism when the requirement is to restrict which external IP addresses can connect to the public endpoint.

Disable public network connectivity for the Cosmos DB account is incorrect because turning off public network connectivity blocks all public access and does not provide a way to selectively allow certain external IP addresses. That option is used when you want access only via private endpoints.

Rotate the account primary keys to invalidate existing credentials is incorrect because key rotation affects authentication credentials and does not control network level access or which IP addresses can reach the service.

Use a managed network firewall to inspect and block incoming traffic is incorrect because a managed network firewall such as Azure Firewall inspects and filters traffic for virtual networks or routed traffic and is not the mechanism for applying an allow list directly to a Cosmos DB public endpoint. To restrict direct public access by source IP you would use the Cosmos DB IP firewall or move access to private endpoints.

Full AWS Practitioner Certification Question