I spent far too long stuck because of the direction: “Locate the level that you want to configure.” To me, that implied going to the application or the site. Only the “ISAPI and CGI Restrictions” I wanted was not there. I did all kinds of things thinking that somehow the feature I needed was not installed because I did not see it.

It turned out the setting is only visible at the topmost (server) level. Various documentation fail to describe looking for it there.