I think it will be "Role-based access control" as Resouce Token doesn't cooperate with AD, regarding second part - ARM is correct

RBAC is the answer.

first is RBAC: Azure Cosmos DB RBAC is the ideal access control method in situations where: - You want to use Microsoft Entra identities to authenticate your requests. https://learn.microsoft.com/en-us/azure/cosmos-db/secure-access-to-data?tabs=using-primary-key

RBAC/ARM https://learn.microsoft.com/en-us/azure/cosmos-db/audit-control-plane-logs#disable-key-based-metadata-write-access ・After you set this property, changes to any resource can happen from a user with the proper Azure role and credentials. ・After the disableKeyBasedMetadataWriteAccess is turned on, if the SDK based clients run create or update operations, an error "Operation 'POST' on resource 'ContainerNameorDatabaseName' is not allowed through Azure Cosmos DB endpoint is returned. You have to turn on access to such operations for your account, or perform the create/update operations through Azure Resource Manager, Azure CLI or Azure PowerShell.

RBAC SQL API

For me is Azure Resource Manager API. When disableKeyBasedMetadataWriteAccess is set to true, the metadata operations issued by the SDK are blocked. Alternatively, you can use Azure portal, Azure CLI, Azure PowerShell, or Azure Resource Manager template deployments to perform these operations.

Correct Answer Should be. Grant permission to create containers by using: Role-based access control (RBAC) Create containers by using: SQL (Core) API

More likely to be SQL (Core) API. Permission for Cosmos is required whereas Azure Resource Manager would need portal permissions. https://docs.microsoft.com/en-us/dotnet/api/microsoft.azure.cosmos.database.createcontainerifnotexistsasync?view=azure-dotnet https://github.com/MicrosoftLearning/dp-420-cosmos-db-dev/blob/main/instructions/06-sdk-crud.md#:~:text=Asynchronously%20invoke%20the%20CreateContainerIfNotExistsAsync,CreateContainerIfNotExistsAsync(%22products%22%2C%20%22/categoryId%22%2C%20400)%3B