A web application runs on EC2 instances in an Auto Scaling group behind a public Application Load Balancer (ALB). Only users from a specific country should be able to access the app. The company also needs to log blocked access requests. The solution should require minimal maintenance. Which approach satisfies these requirements?

The correct answer is to create an AWS WAF web ACL with a rule that blocks requests not originating from the specified country and associate it with the ALB. AWS WAF natively supports geo-matching rules, allowing you to filter traffic based on the country of origin, which directly addresses the requirement to restrict access to users from a specific country. WAF also logs all requests, including blocked ones, fulfilling the logging requirement. This is a managed service, ensuring minimal maintenance. Creating an IPSet with IP ranges for a country is less efficient and harder to maintain because country IP ranges change frequently, requiring manual updates. Configuring AWS Shield is incorrect because Shield is primarily a DDoS protection service and does not offer geo-blocking capabilities for specific countries. Creating a security group rule on the ALB is also incorrect because security groups operate at the IP address level and do not have built-in geo-location filtering capabilities.