All Windows Server 2019 machines are onboarded to Microsoft Defender for Endpoint. A legacy app causes heavy CPU during scans. You must: 1) exclude C:\ProgramData\LegacyApp\Data and the process C:\Program Files\LegacyApp\app.exe from scans, 2) run a daily quick scan and a weekly full scan on a schedule, 3) prevent local admins from disabling Microsoft Defender Antivirus, and 4) enable cloud-delivered protection with aggressive blocking. Which option meets all requirements?

The correct option addresses all requirements. Scheduled Tasks with MpCmdRun.exe are the standard way to schedule scans on Windows Server 2019. Set-MpPreference -ExclusionPath and -ExclusionProcess correctly configure the necessary exclusions. Enabling Tamper Protection in the Microsoft Defender portal prevents local administrators from disabling Microsoft Defender Antivirus settings. Finally, Set-MpPreference -MAPSReporting Advanced -CloudBlockLevel High enables cloud-delivered protection with aggressive blocking. The other options are incorrect because: Enabling Tamper Protection locally via registry is not the recommended or most effective method for server groups, and secpol.msc is not used for Defender exclusions. Relying solely on real-time protection doesn't fulfill scheduled scan requirements, and disabling Tamper Protection is counter to the requirement of preventing local admin changes. A GPO for weekly full scans is incomplete, wildcard exclusions are not specific enough, and relying on instructions for admins doesn't enforce the "prevent" requirement.