A network engineer is defining the ISE internal CA certificate template used to issue certificates to endpoints during BYOD onboarding. The engineer wants the issued certificates to be usable for 802.1X EAP-TLS authentication where the endpoint acts as the client presenting its certificate to ISE. Which Extended Key Usage (EKU) value must be included in the certificate template so the issued endpoint certificates are valid for this purpose?