I don't know what 'VDO' means - anyway, the quiz can impose one of the heavier loads.
All you can do is to give your client the design criteria you used and a price. My experience is that they always come quoting some huge figure for concurrency and then are horrified when you quote the cost to support that.
If you have 2,000 users a month (that is a maximum of 2,000 users in a monthly period) you can't possibly have all 2,000 logged in at once. Well, I would hope not - certainly if they can enroll by themselves. I think your figure of 500 is more realistic.
For this you may get away with a single *large* box for the web front end (say 32GB RAM, 8 cores-ish) and a similar box for the database. If you want some confidence and to be nearer the 1,000 mark then double the front ends and load balance them (simple round-robin or, better, a proper load balancer).
It doesn't sound like you will have a massive file storage requirement so you shouldn't need anything special for that.
Of course, you need to know what you are doing to tune these up to optimise the available resources and you need to monitor them very carefully as you roll out the system.
This is with the huge caveat that you really don't know until you have run the system and obtained some data.