The correct option is Automatic encryption at rest.

Automatic encryption at rest is the Cosmos DB capability that ensures data is encrypted while it is persisted to disk. Cosmos DB encrypts stored data by default using service managed keys and this automatic server side encryption meets the requirement to have records encrypted when they reside on disk.

Client-side encryption is incorrect because it refers to encrypting data before it leaves the client. That approach protects sensitive values under client control but it is not the built in server side disk encryption feature that the question asks about.

Transparent Data Encryption (TDE) is incorrect because TDE is an Azure SQL database feature and it is not the mechanism used by Azure Cosmos DB for encryption at rest.

Customer-managed keys is incorrect in this context because it describes who controls the encryption keys rather than the automatic server side encryption capability itself. Customer managed keys can be used to control key ownership and rotation but the option that directly ensures disk encryption is automatic encryption at rest.

Full AWS Practitioner Certification Question