Restricting the export feature based on user roles is the correct answer because it applies role-based access controls to limit the ability to export data only to users whose job responsibilities require that functionality. Read-only access does not specifically prevent the export of data, it just prevents data modification. Enforcing password complexity is a good practice for securing accounts but does not govern feature usage within an application. Encryption of data at rest secures data from unauthorized access if the storage medium is compromised but does not control the access to application features.