For an AWS Lambda function used by a city chatbot, which split correctly separates AWS and customer responsibilities?
Select an answer to reveal the explanation.
Short Explanation
AWS runs and patches the Lambda execution environment, so you don't own that layer. But if your city's developers hard-code secrets in function code, that's on you. Think managed runtime, not managed application code.
Full Explanation
For AWS Lambda, the correct split is the option stating that AWS operates and patches the Lambda execution environment while the city is responsible for insecure secrets hard-coded in function code. For AWS Lambda, AWS operates and patches the Lambda execution environment, while the city remains responsible for insecure secrets hard-coded in function code and for the correctness and security of that application logic. The option saying the city patches the Lambda execution environment and AWS hard-codes application secrets is wrong because the city does not patch the managed Lambda runtime, and AWS does not hard-code application secrets for the customer. The option saying AWS and the city jointly edit Lambda hypervisor firmware for each function deploy is wrong because jointly editing Lambda hypervisor firmware on each deploy is not a municipal engineering task under shared responsibility. The option saying AWS patches customer function source code and the city maintains Lambda host firmware is wrong because AWS does not patch customer function source code as if it were routine OS package maintenance, nor does the city maintain Lambda host firmware in AWS facilities. Distractors that assign source-code patching to AWS while giving firmware duties to the city reverse the model. Claims that the city patches the Lambda execution environment misunderstand serverless boundaries. The kitchen analogy holds for civic chatbot or API functions: AWS keeps the managed runtime environment maintained; city developers still must not tape database passwords or API tokens into source. Exam caveat: serverless shifts more infrastructure duty to AWS without deleting customer accountability for code quality, IAM execution roles, dependency hygiene, and secret handling. Operational check: scan function code and CI artifacts for embedded credentials, store secrets in AWS Secrets Manager or Parameter Store with encryption, apply least-privilege execution roles, review environment variables for sensitive material, and keep third-party libraries updated as part of the city's application security process before promoting functions that touch resident data.