After creating an LDAP group on Citrix ADC whose name exactly matches the LDAP group, what is the next required step to assign permissions?

• A. Add users to the group on the Citrix ADC
• B. Bind an AAA action to the group
• C. Create a command policy for the group
• D. Add a nested group

Answer: (C)

The main idea is controlling what LDAP group members can do on the Citrix ADC by defining exact CLI permissions. After the LDAP group is created on the ADC with the same name as the LDAP group, you need to specify what commands those users are allowed to run. That’s done by creating a command policy for the group and then binding that policy to the group. Once the policy is bound, any member of that LDAP group will have the permissions defined in the policy.

This step is essential because simply having an LDAP group mapped to the ADC doesn’t grant any CLI rights by itself. There’s no need to manually add users to the ADC group since membership comes from LDAP. Nested groups aren’t required for this step, unless you have a specific LDAP structure. Binding an AAA action alone doesn’t define the exact CLI permissions—that’s what the command policy provides.