Question

A financial services company runs an Azure Cosmos DB for NoSQL account that must only be reachable from resources inside a specific Azure virtual network. Corporate security policy requires that no traffic ever traverses the public internet, and the account must not be resolvable or reachable via its public endpoint at all. Application servers reside in a subnet within that virtual network. Which configuration meets these requirements?

Accepted Answer

Create a Private Endpoint for the account in the virtual network and set public network access to Disabled.

Answer

Add the virtual network subnet to the account's IP firewall allow-list and leave public network access enabled.

Answer

Enable a service endpoint for Microsoft.AzureCosmosDB on the subnet and keep the default public network access setting.

Answer

Configure customer-managed keys in Azure Key Vault and restrict Key Vault access to the virtual network.