An organization wants to allow remote employees to access internal resources. The security team must choose between a split-tunnel VPN and a full-tunnel VPN. Which statement BEST describes the security trade-off?

Split-tunnel is correct because it only routes corporate-destined traffic through the VPN, so internet traffic bypasses corporate security controls and monitoring. Full-tunnel routes all traffic through corporate infrastructure, giving full visibility and control. Full-tunnel exposing the corporate network to internet threats while split-tunnel keeps internet traffic isolated is wrong because full-tunnel controls all traffic rather than exposing the corporate network. Split-tunnel encrypting all traffic end-to-end while full-tunnel only encrypts the tunnel portion is wrong because encryption behavior is not the differentiator. Full-tunnel being less secure because routing more traffic through VPN concentrators increases attack surface is wrong because routing more traffic through the VPN increases inspection opportunities.