Refer to the exhibit.

Refer to the exhibit. An engineer must implement a remote access VPN solution that provides user and device verification. The company uses Active Directory for user authentication and ID certificates for device identity. Users are currently able to connect using only a valid username and password, even if their computer is missing the required certificate.

Which command from the Cisco ASA tunnel-group completes the requirement of verifying device identity in addition to user identity?