An engineer notices that while an employee is connected remotely, all traffic is being routed to the corporate network. Which split-tunnel policy allows a remote client to use their local provider…

tunnelall forces every packet from the remote client through the VPN tunnel, which is exactly the behavior the engineer is trying to eliminate.

excludeall prevents any traffic from entering the tunnel, effectively breaking all VPN connectivity to corporate resources.

With tunnelspecified, only traffic destined for networks listed in the split-tunnel ACL is encrypted and forwarded through the VPN tunnel. All remaining traffic, including general Internet browsing, exits directly through the client's local ISP, resolving the problem of all traffic being backhauled through the corporate network.

excludespecified is the inverse of tunnelspecified - it sends all traffic through the VPN except explicitly excluded networks, which still routes most traffic through corporate.