A healthcare application stores patient records in Azure Cosmos DB for NoSQL. Compliance requires that the 'nationalId' property be encrypted client-side so that plaintext is never visible to the database engine. Developers must still be able to run queries that filter documents using an exact-match equality predicate on 'nationalId'. When configuring Always Encrypted for this property, which encryption type must you select?