A company is deploying a new policy that restricts access to Cisco Catalyst SD-WAN Manager features based on VPN groups, segments, and users. Which configuration accomplishes this task?

Assigning 'netadmin' as the user group for VPN_Group_10 with 'Enable User Group access' enabled correctly implements VPN-based role access control - the 'netadmin' built-in group has the appropriate network administration privileges for managing VPN segment resources. This configuration scopes which user groups can access or manage the resources tied to that specific VPN group, fulfilling the policy requirement of segmenting access by VPN group and user.

The 'operator' user group has read-only or limited operational access and is not the correct role for administering VPN group-based access restrictions in this context.

Leaving the User Group field empty produces an incomplete configuration that does not associate any users with the VPN group, so no user-level access restriction is actually enforced.

The 'admin' user group has unrestricted system-wide access and assigning it to a VPN group does not meaningfully restrict access - it defeats the purpose of the segmented policy.

With 'Enable User Group access' unchecked, the VPN group configuration ignores user group membership entirely, leaving user-level access restrictions disabled.