An access control vestibule (also called a mantrap) is a physical security space with two interlocking doors where the first must close before the second opens, letting only one authenticated person through at a time to prevent piggybacking and tailgating into a restricted area.
An access control vestibule is a small room with two doors that won't both be open at once. You badge in through the first door, it closes behind you, and only then can the second door unlock. Think of it as an airlock for people. You're trapped in the middle for a moment, which is why the older name for it is a mantrap.
The whole point is to control how many people enter a restricted space at a time. A single badge-locked door is easy to defeat, someone authorized opens it and a stranger slips in behind them. The vestibule kills that move. Because only one person can be in the space and clear the second door, an adversary can't ride in on someone else's access.
This term lives in Unit 2: Securing Spaces, under Topic 2.2 Physical Vulnerabilities and Attacks. It directly supports [AP Cybersecurity 2.2.A], identifying common physical attacks, because the vestibule is the textbook defense against piggybacking (EK 2.2.A.2). It also connects to [AP Cybersecurity 2.2.C], assessing and documenting risk, since EK 2.2.C.1 makes the big point: physical access to a device lets an adversary bypass most technical controls. If someone walks into your server room, your firewalls don't matter much. The vestibule is one of the controls you'd recommend to shrink that risk.
Keep studying AP Cybersecurity Unit 2
Visual cheatsheet
view galleryPiggybacking (Unit 2)
Piggybacking is the attack; the vestibule is the counter. An adversary tries to slip in behind an authorized person, and the two-door, one-at-a-time design makes that physically impossible.
Badge access (Unit 2)
A vestibule almost always uses badge access on its doors. The badge proves who you are, and the vestibule enforces that only that one badged person gets through before the next can enter.
Physical perimeter (Unit 2)
The vestibule is one layer of a defense-in-depth perimeter that also includes fencing and bollards. It guards the entry point itself, while the outer controls keep people away from the building in the first place.
Motion sensor (Unit 2)
Vestibules pair well with detection controls like motion sensors. The vestibule prevents unauthorized entry, while sensors flag anything suspicious if someone does get past the outer layers.
Expect this as a defense in a multiple-choice question about physical attacks. A stem will describe an adversary carrying a large box to get someone to hold a door, or pretending to be a forgotten-badge employee, and the right control to stop it is the access control vestibule. On the free-response side, you may be asked to recommend physical controls for a risk scenario like an unlocked server room (EK 2.2.C.2). Naming a vestibule, and explaining that it blocks piggybacking by allowing only one authenticated person through at a time, is the kind of specific, justified answer that earns points. Don't just list the term; connect it to the threat it addresses.
Badge access is the authentication step, it checks who you are. An access control vestibule is the enforcement structure that makes sure only that one authenticated person enters before the next door opens. Badge access alone still lets someone tailgate in behind you; the vestibule is what closes that gap.
An access control vestibule is a two-door space where the first door must close before the second opens, letting only one person through at a time.
Its main job is to defeat piggybacking and tailgating, where an unauthorized person slips in behind an authorized one.
It's also called a mantrap, and it works like an airlock for people.
It usually combines with badge access: the badge proves identity, the vestibule enforces one-at-a-time entry.
On the exam, it's the go-to answer when a question describes a social-engineering attack to follow someone through a door.
It's a physical security space with two interlocking doors where the first must close before the second opens, so only one authenticated person enters a restricted area at a time. It appears in Unit 2, Topic 2.2, as a defense against piggybacking.
Yes. That's its whole purpose. Because the two doors never open together and only one person can clear the inner door, an adversary can't ride in behind an authorized person.
Badge access is the authentication, it confirms who you are. The vestibule is the structure that enforces one-person-at-a-time entry. Badge access alone still lets someone tailgate through an open door; the vestibule physically blocks that.
Yes, mantrap is the older name for the same thing. Both describe a two-door entry that traps you between doors until the system confirms only you are passing through.
Because physical access can bypass technical controls (EK 2.2.C.1). If an adversary physically reaches a device, firewalls and encryption may not protect it, so controlling who enters the space is its own critical layer.
Connect this key term to the AP exam workflow: review the course, practice questions, and check related study tools.