Microsoft Defender for Servers Plan 1 を使用し、Server1 という名前のサーバーを含む Azure サブスクリプションがあります。 エージェントレス スキャンを有効にします。 Server1 がスキャンされないようにする必要があります。ソリューションでは、管理労力を最小限に抑える必要があります。 あなたは何をするべきか?
正解:A
With Defender for Servers Plan 1 or Plan 2 , agentless scanning for vulnerabilities is enabled to assess connected servers automatically. To exclude specific servers (like Server1 ) from being scanned, Microsoft recommends using exclusion tags . An exclusion tag is a key-value metadata pair (for example, DefenderForCloud.AgentlessScan = Exclude ) applied to resources to exclude them from certain Defender for Cloud assessments, including agentless vulnerability scanning. This approach is lightweight and requires no policy or plan upgrade , satisfying the requirement to minimize administrative effort. Other options explained: * Upgrade to Plan 2: Not required; exclusion works in Plan 1 and Plan 2. * Create a governance rule: Used for compliance automation, not scanning exclusions. * Create an exclusion group: Not a valid Defender for Cloud configuration concept. # Correct answer: A. Create an exclusion tag