A C

Configure Login IP Ranges on user profiles and
Enable the "Lock sessions to the IP address from which they originated" setting.

This ensures that only users with IP addresses within the defined range can log in, and their sessions are tied to that specific IP address.

Here's why these are the best choices:

Login IP Ranges:
This feature allows administrators to specify a list of allowed IP addresses or ranges for each user profile. Users attempting to log in from outside these ranges will be denied access.

Lock sessions to the IP address:
When enabled, this setting prevents users from accessing Salesforce if their IP address changes during a session. This helps prevent session hijacking and unauthorized access from different locations.

The other options are not as effective:

Using a login flow to validate the IP and request a 2nd factor:

While a login flow can add an extra layer of security, it doesn't inherently restrict access to a specific network. It's a good practice for MFA but doesn't address the core requirement of network-based access control.

Using a trigger to change the user's profile based on IP:

Triggers in Salesforce are designed to handle data changes, not network-level access control. They are not suitable for enforcing IP restrictions....

It seems A and C are correct.
https://help.salesforce.com/s/articleView?id=sf.admin_sessions.htm&type=5