A company deployed AWS Client VPN so remote users can reach resources in multiple peered VPCs and the on-premises datacenter. The Client VPN endpoint route table contains only 0.0.0.0/0. The endpoint’s security group has no inbound rules and a single outbound rule permitting all traffic to 0.0.0.0/0. Several remote users report web search results are showing incorrect geographic location data for them. Which combination of steps should a network engineer take to fix this with the LEAST service disruption? (Choose three.)

The issue of incorrect geographic location data indicates that users' internet traffic is being routed through the AWS Client VPN, causing their public IP to appear as an AWS IP. This is due to the Client VPN operating in full-tunnel mode, where all traffic (including internet-bound traffic) is sent through the VPN. To fix this with the least disruption, implement split-tunneling. 1. Enable split-tunnel mode on the Client VPN endpoint. This configures the Client VPN to only route traffic destined for specified networks through the VPN tunnel, allowing internet traffic to bypass the VPN. 2. Remove the 0.0.0.0/0 entry from the Client VPN endpoint route table. This ensures that the Client VPN no longer attempts to route all traffic through itself. 3. Add explicit routes for the peered VPCs and the on-premises datacenter to the Client VPN route table. This ensures that only traffic intended for these internal resources is routed through the VPN. Switching to Site-to-Site VPNs is a different service for site-to-site connectivity, not remote user access. Deleting and recreating the endpoint is highly disruptive. Removing the 0.0.0.0/0 outbound rule from the security group would block all outbound traffic from the endpoint, preventing access to any resources.