To specify permission level for LDAP-based admin, what should be bound to the LDAP group?

• A. A command policy to the group
• B. A nested group to the new group
• C. Users to the group
• D. An authentication, authorization, and auditing (AAA) action to the group

Answer: (A)

The permission level for LDAP-based admins is defined by binding a command policy to the LDAP group. A command policy specifies exactly which CLI commands and actions are allowed or denied for an admin. When you attach this policy to the group, every member inherits those restrictions, so their privileges are controlled uniformly. This separation—LDAP for who the user is (group membership) and command policy for what they can do—provides centralized and precise privilege management.

Binding a nested group to the new group would affect only group structure, not command permissions. Binding users to the group determines who is in the group, not the level of access. An AAA action governs authentication, authorization, and auditing in a broader sense, but it doesn’t define the granular command permissions used to specify admin capabilities.