Which of the following can be used to control specific commands that can be executed on a network infrastructure device?

LDAP is primarily a directory service protocol used for authentication and retrieving user information, but it does not inherently offer granular command-level authorization capabilities for network devices.

Kerberos is a network authentication protocol that uses tickets to verify user identities, but it does not provide the facility to control specific commands executed on network infrastructure devices.

SAML is an XML-based standard for exchanging authentication and authorization data, predominantly used for web-based single sign-on and federated identity, not for command authorization on network devices.

TACACS+ (Terminal Access Controller Access-Control System Plus) is an AAA protocol that distinctly separates its authorization component, allowing administrators to define precise command sets or individual commands that users are permitted to execute on network infrastructure devices. This granular per-command authorization directly fulfills the requirement of controlling specific commands.