The correct answer is Require users to simply ignore suspicious emails and avoid clicking links or opening attachments.

Relying solely on user behavior is the weakest defense because humans make mistakes and social engineers craft messages to bypass suspicion. Training and awareness are valuable, but they cannot guarantee that every user will recognize a sophisticated phishing message or that an attacker will not exploit unusual context to trick a user. Technical and automated controls are needed so a single human error does not lead to full compromise.

Implement stringent password complexity and rotation rules is not the weakest choice because password policies reduce credential guessing and provide a technical control. Modern guidance does caution against frequent forced rotations as they can reduce security, but password controls still add value when combined with other defenses.

Deploy endpoint antivirus on all corporate devices is not the weakest choice because endpoint protection can detect and block known malicious attachments and malware delivered by phishing. It is not perfect against credential harvesting via web based phishing, but it is a concrete technical mitigation that reduces risk compared with relying only on users.

Enable two step verification with Google Workspace is not the weakest choice because two step verification adds a second factor that makes account takeover much harder even if credentials are phished. Multi factor authentication is one of the stronger controls listed and it compensates for human error.

Full AWS Practitioner Certification Question