In AP Cybersecurity, an ACL (access control list) is a set of rules attached to a resource that specifies which users or systems can access it and what actions they are allowed to perform, enforcing authorization after a user's identity is verified.
An ACL (access control list) is basically a guest list for a resource. Once a system knows who you are, the ACL decides what you're actually allowed to do with a file, folder, device, or network connection.
Think of it as a table of entries. Each entry says something like "this user can read this file" or "this group can read and write, but not delete." When you try to access something, the system checks the ACL and grants or denies the action based on those rules. ACLs are how the abstract idea of authorization becomes a concrete list the computer can enforce. Authentication (Topic 4.2) proves you are who you say you are; the ACL then enforces what that verified identity is permitted to touch.
ACLs live in Unit 4: Securing Devices, right alongside authentication in Topic 4.2. The CED separates two questions: proving identity (authentication) and controlling what that identity can do (authorization). Learning objective [AP Cybersecurity 4.2.C] focuses on the authentication factors that verify a user, and the ACL is what kicks in afterward to enforce permissions. Configuring login settings to make a device more secure ([AP Cybersecurity 4.2.D]) and managing access lists are two sides of the same securing-devices coin. If you understand that authentication and authorization are different steps, the role of the ACL clicks into place.
Keep studying AP Cybersecurity Unit 4
Visual cheatsheet
view galleryAccess control and authorization (Unit 4)
An ACL is the practical tool that implements authorization. Access control is the broad goal of limiting who gets to do what; the ACL is the literal list that makes it happen for a specific resource.
DAC, MAC, RBAC, and RuBAC (Unit 4)
These are access control models, and ACLs show up inside most of them. In DAC (discretionary access control), the owner of a resource edits its ACL directly, which is the most common everyday version you'll see.
Authentication factors (Topic 4.2)
Knowledge, possession, biometric, and location factors verify who you are. The ACL only matters once that verification succeeds, because it grants permissions to a confirmed identity, not to an anonymous request.
Bell-LaPadula model (Unit 4)
Bell-LaPadula is a formal rule set for confidentiality (no read up, no write down). ACLs are one way those access decisions get recorded and enforced on real systems.
Expect ACL to appear in multiple-choice questions that test whether you can tell authentication from authorization. A stem might describe a user who logs in successfully but still can't open a file, and the right answer points to the ACL or permissions, not the password. You may also see ACLs tied to a specific access control model like DAC. The move you need to make: identify that verifying identity and controlling permissions are separate steps, and that the ACL handles the permissions step. No released FRQ has used this term verbatim, but ACL concepts support the kind of device-securing reasoning Unit 4 questions reward.
Authentication asks "who are you?" and verifies it with a factor like a password or fingerprint. An ACL asks "now that I know who you are, what are you allowed to do?" Authentication comes first; the ACL enforces permissions after. Mixing these up is the classic Unit 4 mistake.
An ACL (access control list) is a set of rules attached to a resource that says which users can access it and what actions they can take.
ACLs handle authorization, which is a separate step from authentication; authentication proves identity first, then the ACL enforces permissions.
ACLs are the tool that makes access control models like DAC, MAC, RBAC, and RuBAC actually work on a device.
On the AP exam, a question where someone logs in fine but still can't access a file usually points to an ACL or permission setting, not a password problem.
ACLs live in Unit 4 (Securing Devices) and connect directly to the authentication concepts in Topic 4.2.
An ACL (access control list) is a set of rules tied to a resource, like a file or device, that defines which users or systems can access it and what they're allowed to do, such as read, write, or delete.
No. Authentication verifies who you are using a factor like a password or biometric. An ACL handles authorization, deciding what your verified identity is allowed to do. Authentication happens first, then the ACL enforces permissions.
Access control is the broad goal of limiting who can do what. An ACL is one specific way to enforce it: an actual list of permission rules attached to a resource.
It connects to Unit 4 (Securing Devices) and Topic 4.2 (Authentication), especially questions that test whether you can separate verifying identity from controlling permissions.
In discretionary access control (DAC), the owner of a resource edits its ACL to grant or remove permissions. The ACL is the actual mechanism that DAC uses to record who can do what.
Connect this key term to the AP exam workflow: review the course, practice questions, and check related study tools.