docs: explain reduced scan scope results (#12032)

docs/user-guide/tutorials/prowler-app-scan-configuration.mdx

@@ -8,7 +8,7 @@ import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
 
 <VersionBadge version="5.32.0" />
 
-Scan Configuration lets you override, per provider, specific values in the default configuration Prowler's checks use during a scan. Each configuration modifies how specific checks behave, e.g.: thresholds, allowed values, retention windows, and you attach it to the providers that you want to use it on their next scan.
+Scan Configuration lets you override, per provider, specific values in the default configuration Prowler's checks use during a scan. Each configuration can modify how specific checks behave, such as thresholds, allowed values, and retention windows, or exclude checks and services from the scan scope. Attach it to the providers that should use it on their next scan.
 
 <SubscriptionBanner />
 
@@ -54,6 +54,24 @@ gcp:
   storage_min_retention_days: 30
 ```
 
+### Limiting the Scan Scope
+
+<VersionBadge version="5.35.0" />
+
+Use `excluded_checks` to skip individual checks and `excluded_services` to skip every check in a service for the matching provider type:
+
+```yaml
+aws:
+  excluded_checks:
+    - s3_bucket_public_access
+  excluded_services:
+    - ec2
+```
+
+<Warning>
+When a Scan Configuration excludes checks or services, Prowler calculates overviews, aggregations, and other result-based information from the reduced scan scope. The displayed information reflects only the checks and services that ran, not a complete assessment of the provider. Consider the applied Scan Configuration when interpreting totals and security posture.
+</Warning>
+
 ## Creating a Scan Configuration
 
 <Steps>