Short answer is yes, you can define it at any level. Essentially you can even have different configuration for different hierarchies. You just have to point the sling:configRef to the right location (where your actual CA configs will be available, generally located under /conf).
You may also want to check https://wcm.io/caconfig/ which doesn't come OOB with AEM but provides a good User interface to manage your context aware configurations.
Hope this helps.