A browser application uses an allowed CORS origin and assumes this authorizes all Cosmos DB requests. What should the engineer explain?

1. CORS is not a replacement for authentication, data authorization, or network access rules
2. A CORS entry encrypts every stored item
3. CORS automatically creates a private endpoint
4. CORS grants every caller account administrator rights