Which configuration will meet this requirement?
Configure the security group for the EC2 instances.
Configure the security group on the Application Load Balancer.
Configure AWS WAF on the Application Load Balancer in a VPC.
Configure the network ACL for the subnet that contains the EC2 instances.
Explanations:
Security groups control access at the instance level, but they do not filter traffic based on geographic location.
Security groups on the Application Load Balancer do not provide geo-restriction capabilities; they filter based on IP.
AWS WAF can be configured to allow or block requests based on geographic location, making it suitable for this requirement.
Network ACLs provide subnet-level access control and do not support filtering based on country or geog
As far as I can tell, the answer is:
Configure AWS WAF on the Application Load Balancer in a VPC.