A company has hundreds of Lambda functions and the QA team must invoke them through Lambda function URLs. The QA team is in an IAM group. A developer needs to configure authentication so the QA group can call the public function URLs. Which solution satisfies this requirement?

The correct solution involves configuring Lambda Function URLs with AWSIAM authentication and then granting the QA team permission to invoke them. An identity-based IAM policy attached to the QA group, allowing lambda:InvokeFunctionUrl on all Lambda ARNs, provides the necessary permissions for the QA team to call these authenticated URLs. The incorrect options fail for various reasons: Using NONE authentication would make the function URLs publicly accessible without requiring IAM authentication, which is not desired for a QA team needing specific access. Attaching a resource-based policy to the QA IAM group is not how resource policies work; resource policies are attached to the resource itself (the Lambda function in this case), not to the invoking identity. Creating individual identity-based policies for each function and attaching them to the QA group is inefficient and unnecessary when a single policy can cover all functions.