In serverless architecture, what is a common security consideration?

• A. There is no shared responsibility between provider and customer.
• B. Security is solely the provider's responsibility.
• C. Serverless eliminates all security concerns.
• D. Reduced server management with shared responsibility; concerns include misconfig, access control, and function-level permissions.

Answer: (C)

In serverless environments, security rests on a shared responsibility model: the provider secures the cloud platform, runtime, and infrastructure, while you secure your code, configurations, and data. This means you still must enforce strong access control, manage authentication and authorization for APIs and event sources, and properly handle secrets and environment variables.

Common security concerns include misconfigurations (like exposing functions or storage publicly), overly broad IAM permissions, insecure or leaked credentials, and vulnerable dependencies or insufficient monitoring. Even with reduced server management, these risks require careful setup and ongoing oversight at the function level and in how you control access and data flow.

The idea that there is no shared responsibility or that security is entirely eliminated is incorrect. Serverless lowers operational burden but introduces its own security challenges that you must actively manage through proper permissions, configuration, and monitoring.