With Defender for Servers Plan 1 or Plan 2, agentless scanning for vulnerabilities is enabled to assess connected servers automatically. To exclude specific servers (like Server1) from being scanned, Microsoft recommends using exclusion tags.

An exclusion tag is a key-value metadata pair (for example, DefenderForCloud.AgentlessScan = Exclude) applied to resources to exclude them from certain Defender for Cloud assessments, including agentless vulnerability scanning. This approach is lightweight and requires no policy or plan upgrade, satisfying the requirement to minimize administrative effort.

Other options explained:

Upgrade to Plan 2: Not required; exclusion works in Plan 1 and Plan 2.

Create a governance rule: Used for compliance automation, not scanning exclusions.

Create an exclusion group: Not a valid Defender for Cloud configuration concept.

✅ Correct Answer: A. Create an exclusion tag