In LDAP integration on Citrix ADC, after creating an LDAP group that matches the LDAP group name, what must be configured to define the group’s permission level?

• A. Add users to the group
• B. Bind a AAA action to the group
• C. Create a command policy for the group
• D. Create a nested group

Answer: (C)

The permission level for an LDAP-backed group on Citrix ADC is defined by a command policy. After the LDAP group name is matched, you create a command policy that specifies exactly which CLI commands members of that group are allowed to run and bind that policy to the group. This is what controls what the group can do on the appliance.

Adding users to the group doesn’t set these rights by itself, and binding a AAA action affects authentication flow more than the specific command-level permissions. Creating a nested group doesn’t define the permissions either.