The correct choice is Amazon WAF because it supports geo match statements to allow or deny web requests from specific countries and you can attach a web ACL to CloudFront, an Application Load Balancer, or API Gateway for enforcement at scale.

With WAF you add a geo match rule to a web ACL and set the action to allow or block traffic from the listed countries. Attaching the web ACL to CloudFront provides global coverage and attaching to an ALB or API Gateway protects regional endpoints and lets you enforce the same country based policy across your application.

AWS Shield is focused on DDoS protection and does not provide country based request filtering or custom web ACL rules.

Amazon Pinpoint is a customer engagement service for messaging and analytics and it cannot block HTTP requests at the edge or at your application endpoints.

Amazon Fraud Detector evaluates events for potential fraud and is not intended to control access by geographic origin.

Full AWS Practitioner Certification Question