A development team moves several APIs from virtual machines to serverless functions on a public cloud platform. A manager asks which security tasks the team still owns now that there are no servers to administer. Which set of tasks remains the team's responsibility?

In a serverless model the provider operates the underlying hosts, runtime environment, scaling, and isolation between tenants, while the customer supplies function code and the configuration that governs it. The customer therefore remains responsible for secure coding and dependency management, the identity and access management permissions assigned to each function, event trigger and network configuration, and the handling of secrets such as API keys and connection strings. Over-permissioned function roles and exposed secrets are among the most common serverless weaknesses, and both sit squarely with the customer. Patching the operating system of the hosts is the provider's task in serverless; customers have no access to those hosts, which is a defining characteristic of the model. Hardening the hypervisor or isolation layer that separates tenants is also a provider responsibility, because the provider builds and operates that platform. Physical data center security belongs to the provider in every public cloud service model. Exam caveat: serverless reduces infrastructure responsibilities but can increase the number of small components, each with its own permissions and triggers, so configuration review becomes more important rather than less. Operational check: apply least-privilege roles to each function, store secrets in a managed secrets service rather than in code or environment files, scan dependencies, and log function invocations.