Which configuration will meet this requirement?

A company’s web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only.

Which configuration will meet this requirement?
A . Configure the security group for the EC2 instances.
B . Configure the security group on the Application Load Balancer.
C . Configure AWS WAF on the Application Load Balancer in a VP
E . Configure the network ACL for the subnet that contains the EC2 instances.

Answer: C

Explanation:

https://aws.amazon.com/es/blogs/security/how-to-use-aws-waf-to-filter-incoming-traffic-from-embargoed-countries/