Refer to the exhibit. Which value must be configured in the User Group field when the Cisco AnyConnect profile is created to connect to an ASA headend with IPsec as the primary protocol?

address-pool defines the IP address range assigned to VPN clients and is not a group identifier used during connection profile selection.

group-alias is a display name that appears in the AnyConnect drop-down menu for SSL VPN connections; it is not used for IPsec IKEv2 group matching.

group-url is an SSL-specific mechanism that maps a URL path to a connection profile and is not applicable when IPsec is the primary protocol.

IPsec IKEv2 uses the tunnel-group name as the identity selector during the IKE negotiation phase to map the client to the correct connection profile on the ASA. The AnyConnect profile's 'User Group' field must exactly match the tunnel-group name configured on the ASA headend so the correct policy, authentication, and authorization settings are applied.