How does the Cisco ASA use Active Directory to authorize VPN users?

How does the Cisco ASA use Active Directory to authorize VPN users?

A.
It queries the Active Directory server for a specific attribute for the specified user.

B.
It sends the username and password to retrieve an ACCEPT or REJECT message from the Active Directory server.

C.
It downloads and stores the Active Directory database to query for future authorization requests.

D.
It redirects requests to the Active Directory server defined for the VPN group.