Your company is planning to test out Amazon workspaces for their account. They are going to allocate a set of workstations with static IP addresses for this purpose. They need to ensure that only these IP addresses have access to Amazon Workspaces. How can you achieve this?

Answer options:

A.Create an IP access control group.
B.Place a WAF in front of Amazon Workspaces.
C.Specify the IP addresses in the NACL.
D.Specify the IP addresses in the Security Group.

Answer – A
The AWS Documentation mentions the following.
An IP access control group acts as a virtual firewall that controls the IP addresses from which users are allowed to access their WorkSpaces. You can associate each IP access control group with one or more directories. You can associate up to 25 IP access control groups with each directory.
Option B is incorrect because a WAF can only be placed in front of an Application Load balancer or a Cloudfront distribution.
Options C and D are incorrect since these are used for traffic control to subnets and EC2 Instances.
For more information on restricting access, one can visit the below URL
https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-ip-access-control-groups.html