A company has several Python AWS Lambda functions deployed as .zip packages and a Lambda layer (also a .zip) with common libraries. The .zip files (functions and layer) are stored in an S3 bucket. The company must automatically scan the Lambda functions and the layer for CVEs. Additionally, a subset of Lambda functions must receive automated code scans for potential data leaks and other vulnerabilities; those code scans must run only for selected functions, not all. Which combination of actions satisfies these requirements? (Choose three.)

Activating Amazon Inspector and starting automated CVE scans directly addresses the requirement for scanning Lambda functions and layers for CVEs. Inspector's standard scanning includes CVE detection for Lambda functions. Activating Lambda standard scanning and Lambda code scanning in Amazon Inspector specifically enables both the general vulnerability scanning (standard) and the more in-depth code analysis for data leaks and other vulnerabilities (code scanning) for Lambda functions. To ensure only a subset of functions receive code scans, tagging functions that do not need code scans with InspectorCodeExclusion:LambdaCodeScanning is the correct method to exclude them from Inspector's code scanning, as per AWS documentation. GuardDuty is for threat detection, not vulnerability scanning. Scanning S3 buckets with Inspector is for S3 bucket vulnerabilities, not for scanning the code within the .zip files for Lambda. Enabling scanning in Lambda function monitor settings is not an Inspector feature for code scanning.