The correct choice is Put Amazon CloudFront in front of the ALB and enable geo restriction to deny the listed countries.

Put Amazon CloudFront in front of the ALB and enable geo restriction to deny the listed countries is the simplest solution because CloudFront enforces country based allow and deny controls at global edge locations and requires only a few configuration steps. This approach blocks unwanted countries before traffic reaches the ALB or your EC2 instances and it can also reduce load on the origin through caching.

Associate an AWS WAF web ACL with the ALB and add a geo match rule to block the specified countries can be used to block by country but it requires provisioning a Web ACL and writing rules which adds complexity and cost when simple edge geo restrictions suffice.

Edit the security group on the ALB to reject connections from those countries is not feasible because security groups do not support geography based rules and they operate as stateful allow lists rather than explicit deny controls.

Use VPC network ACLs to block the public IP ranges for those countries is impractical because it would require maintaining very large and frequently changing lists of IP ranges and network ACLs act at the subnet level which is not efficient for country level blocking.

Full AWS Practitioner Certification Question