Which tag does the PE use to forward a packet to the correct customer?

The correct answer is RT (Route Target). In MPLS VPNs, a PE (Provider Edge) router uses the Route Target extended community to determine which VRF (VPN Routing and Forwarding) a specific VPN route belongs to. When a PE receives a VPNv4 route, it checks the RTs associated with that route against the RTs configured on its local VRFs. If there's a match, the route is imported into that VRF. RD (Route Distinguisher) is used to make VPNv4 routes globally unique, not for forwarding decisions. An extended community is a general BGP attribute, and while RT is an extended community, "extended-community" is too broad. VNI (Virtual Network Identifier) is used in VXLAN, not MPLS VPNs.