A company runs application logic on AWS Lambda across hundreds of AWS accounts managed with AWS Organizations. The company needs to continuously monitor all Lambda functions for vulnerabilities and publish findings to a dashboard. Lambda functions that are in testing or development must not appear on the dashboard. Which combination of actions meets these requirements? (Choose two.)

The correct options address the requirements for continuous vulnerability monitoring of Lambda functions across multiple accounts and filtering out development/testing functions. Amazon Inspector is the AWS service designed for continuous vulnerability management, including Lambda functions. Designating a delegated administrator account in AWS Organizations allows centralized management and viewing of findings across all member accounts from the Inspector dashboard. To exclude testing/development functions, tagging them appropriately and then configuring a suppression filter in Inspector based on these tags is the correct approach. Incorrect options: GuardDuty is for threat detection, not vulnerability management. While it has Lambda protection, its primary function is different from Inspector. AWS Shield Advanced is a DDoS protection service and is irrelevant to Lambda vulnerability scanning. CloudWatch can display metrics but doesn't perform vulnerability scanning itself. The GuardDuty option incorrectly applies GuardDuty's Lambda protection, which focuses on runtime threats, not vulnerability scanning, and uses an incorrect tagging scheme for exclusion.