How should the SysOps administrator configure Client VPN to meet these requirements?
Associate the Client VPN endpoint with a private subnet that has an internet route through a NAT gateway.
On the Client VPN endpoint, turn on the split-tunnel option.
On the Client VPN endpoint, specify DNS server IP addresses.
Select a private certificate to use as the identity certificate for the VPN client.
Explanations:
Associating the Client VPN endpoint with a private subnet that has an internet route through a NAT gateway would allow traffic to route to the internet, which violates the requirement of limiting traffic to the VPC only.
Enabling split-tunneling ensures that only traffic destined for the VPC will travel through the VPN tunnel, while other traffic can go directly to the internet, meeting the compliance requirement.
Specifying DNS server IP addresses does not influence the routing of traffic through the VPN tunnel. It does not restrict traffic to the VPC.
Selecting a private certificate for identity authentication does not affect traffic routing or compliance with the requirement of limiting traffic to the VPC.
I surmise that the answer is:
On the Client VPN endpoint, turn on the split-tunnel option.