The correct answer is Limit surveillance to a small set of employees while excluding the rest. This option should be avoided because selectively surveilling only a subset of staff creates inconsistent treatment and significant legal and ethical risks.

Applying monitoring unevenly can be discriminatory and it undermines trust and morale. Consistent, documented practices help an organization show that monitoring is proportionate and lawful and they reduce the chance of complaints or litigation.

Good monitoring programs include clear notice to employees, defined access roles, and retention rules so that oversight is accountable and limited to business needs. These elements support privacy principles and help meet regulatory expectations.

Publish an acceptable use policy that defines allowable e-mail activities is not something to avoid because publishing an AUP sets expectations and provides a basis for lawful monitoring when it is communicated and enforced.

Inform all personnel that their e-mail may be inspected is not something to avoid because notice to employees is a key part of lawful and ethical monitoring and it promotes transparency.

State which roles may access mail and how long archives are kept is not something to avoid because defining access and retention limits risk and demonstrates accountability and data minimization.

Full AWS Practitioner Certification Question