---
title: "Turnstile — AP Cybersecurity Definition & Exam Guide"
description: "A turnstile is a physical access control that lets one person through at a time to stop tailgating, a key Unit 2 defense against physical attacks."
canonical: "https://fiveable.me/ap-cybersecurity/key-terms/turnstile"
type: "key-term"
subject: "AP Cybersecurity"
unit: "Unit 2"
---

# Turnstile — AP Cybersecurity Definition & Exam Guide

## Definition

A turnstile is a physical access control barrier that admits one person at a time, usually after they badge in, to prevent multiple people from entering a restricted space on a single authorization.

## What It Is

A turnstile is a physical barrier at an entry point that only lets one person pass per authorized credential. Think of the [gates](/ap-cybersecurity/unit-2/protecting-physical-spaces/study-guide/PhHFFwPlXGtEWL781jEc "fv-autolink") you push through at a subway station or a stadium. In a secure building, you badge in, the turnstile unlocks, and exactly one body gets through before it locks again.

That "one person at a time" rule is the whole point. Most [physical attacks](/ap-cybersecurity/unit-2/detecting-physical-attacks/study-guide/Kb72LoynxAj68H4P71eN "fv-autolink") rely on getting more people through a door than were actually authorized. A turnstile makes that physically awkward or impossible, which is why it shows up in [Unit 2](/ap-cybersecurity/unit-2 "fv-autolink") as a control against the social-engineering attacks described in topic 2.2.

## Why It Matters

Turnstiles live in **Unit 2: Securing Spaces**, specifically topic 2.2 (Physical Vulnerabilities and Attacks). They directly support **[AP Cybersecurity](/ap-cybersecurity "fv-autolink") 2.2.A**, identifying common physical attacks, because a turnstile is a countermeasure to [piggybacking](/ap-cybersecurity/key-terms/piggybacking "fv-autolink") and tailgating (EK 2.2.A.2). They also matter for **AP Cybersecurity 2.2.B** and **AP Cybersecurity 2.2.C**: physical access can bypass technical controls (EK 2.2.C.1), so a barrier that controls who actually enters a space lowers the risk of unauthorized access to sensitive systems. The big theme here is that strong passwords and firewalls mean nothing if an adversary can just walk into the server room behind someone else.

## Connections

### Piggybacking and tailgating (Unit 2)

A turnstile is basically the physical answer to piggybacking. Since piggybacking relies on slipping through a held-open door behind an authorized person, a one-person-per-badge turnstile removes the held door entirely.

### [Badge access (Unit 2)](/ap-cybersecurity/key-terms/badge-access)

Turnstiles and badge readers are a team. The badge proves you're authorized, and the turnstile enforces that only the badge holder, not a crowd, actually walks through.

### [Access control vestibule (Unit 2)](/ap-cybersecurity/key-terms/access-control-vestibule)

Both solve the same problem in different ways. A vestibule (mantrap) traps you between two doors so only one person clears at a time, while a turnstile uses a rotating or retracting barrier for the same one-at-a-time effect.

### [Physical perimeter (Unit 2)](/ap-cybersecurity/key-terms/physical-perimeter)

A turnstile is one layer in a larger [physical perimeter](/ap-cybersecurity/key-terms/physical-perimeter "fv-autolink") that also includes fencing, bollards, and locks. It controls people at the entrance, while those other controls keep vehicles and intruders away from the building entirely.

## On the AP Exam

Expect turnstiles in multiple-choice questions that ask you to match a physical control to the attack it stops. A classic stem describes someone trying to follow an employee into a restricted area, then asks which control prevents it. Turnstile (or access control vestibule) is the answer because both enforce one person per authorization. No released FRQ has used this term verbatim, but it fits any free-response that asks you to recommend physical controls to reduce risk for a sensitive space, exactly the kind of assessment described in 2.2.C. Be ready to explain WHY it works: it physically blocks the extra person rather than just trusting people to be honest.

## turnstile vs access control vestibule

Both let only one person through at a time, but the mechanism differs. A turnstile is a single rotating or retracting barrier you push through after badging, while an access control vestibule (mantrap) is a small sealed room with two doors where the second door won't open until the first closes and you're verified.

## Key Takeaways

- A turnstile is a physical barrier that admits one person per authorized credential, usually paired with a badge reader.
- Its main job is stopping piggybacking and tailgating, where an extra person slips into a restricted area behind someone authorized.
- On the exam, match turnstiles to attacks that exploit doors being held open or people following others inside.
- Turnstiles support AP Cybersecurity 2.2.A by countering the social-engineering physical attacks in EK 2.2.A.2.
- Physical controls like turnstiles matter because physical access can bypass technical security entirely (EK 2.2.C.1).

## FAQs

### What is a turnstile in cybersecurity?

It's a [physical access](/ap-cybersecurity/unit-2/physical-vulnerabilities-and-attacks/study-guide/ZcvQYEyowkyIYrjESpUp "fv-autolink") control barrier that lets only one person through at a time after they badge in. In AP Cybersecurity Unit 2, it's a defense against physical attacks where adversaries try to enter a restricted space behind an authorized person.

### Does a turnstile stop piggybacking?

Yes, that's its core purpose. Piggybacking relies on an attacker following an authorized person through a door, and a turnstile physically allows only one person per badge, so the attacker can't slip through.

### How is a turnstile different from an access control vestibule?

Both enforce one person at a time, but a turnstile is a single rotating or retracting gate you push through, while an [access control vestibule](/ap-cybersecurity/key-terms/access-control-vestibule "fv-autolink") is a small two-door room (a mantrap) where the second door stays locked until you're verified and the first door closes.

### Is a turnstile a technical control or a physical control?

It's a physical control. AP Cybersecurity stresses that physical access can defeat technical controls like passwords and firewalls (EK 2.2.C.1), so physical barriers like turnstiles are a separate, important layer of defense.

### Why does a turnstile matter for the AP Cybersecurity exam?

It's a go-to example for topic 2.2 questions that ask which control prevents a specific physical attack. You should be able to pair it with badge access and explain that it enforces one person per authorization to block tailgating.

## Related Study Guides

- [2.2 Physical Vulnerabilities and Attacks](/ap-cybersecurity/unit-2/physical-vulnerabilities-and-attacks/study-guide/ZcvQYEyowkyIYrjESpUp)

## Structured Data

```json
{"@context":"https://schema.org","@graph":[{"@type":"LearningResource","@id":"https://fiveable.me/ap-cybersecurity/key-terms/turnstile#resource","name":"Turnstile — AP Cybersecurity Definition & Exam Guide","url":"https://fiveable.me/ap-cybersecurity/key-terms/turnstile","learningResourceType":"Concept explainer","educationalLevel":"AP® / High School","about":{"@id":"https://fiveable.me/ap-cybersecurity/key-terms/turnstile#term"},"audience":{"@type":"EducationalAudience","educationalRole":"student"},"dateModified":"2026-06-15T18:59:31.787Z","isPartOf":{"@type":"Collection","name":"AP Cybersecurity Key Terms","url":"https://fiveable.me/ap-cybersecurity/key-terms"},"publisher":{"@type":"Organization","name":"Fiveable","url":"https://fiveable.me"}},{"@type":"DefinedTerm","@id":"https://fiveable.me/ap-cybersecurity/key-terms/turnstile#term","name":"turnstile","description":"A turnstile is a physical access control barrier that admits one person at a time, usually after they badge in, to prevent multiple people from entering a restricted space on a single authorization.","url":"https://fiveable.me/ap-cybersecurity/key-terms/turnstile","inDefinedTermSet":{"@type":"DefinedTermSet","name":"AP Cybersecurity Key Terms","url":"https://fiveable.me/ap-cybersecurity/key-terms"},"educationalAlignment":[{"@type":"AlignmentObject","alignmentType":"educationalSubject","educationalFramework":"AP® Course and Exam Description","targetName":"AP Cybersecurity Unit 2, Topic 2.2, LO 2.2.A"},{"@type":"AlignmentObject","alignmentType":"educationalSubject","educationalFramework":"AP® Course and Exam Description","targetName":"AP Cybersecurity Unit 2, Topic 2.2, LO 2.2.B"},{"@type":"AlignmentObject","alignmentType":"educationalSubject","educationalFramework":"AP® Course and Exam Description","targetName":"AP Cybersecurity Unit 2, Topic 2.2, LO 2.2.C"}]},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is a turnstile in cybersecurity?","acceptedAnswer":{"@type":"Answer","text":"It's a [physical access](/ap-cybersecurity/unit-2/physical-vulnerabilities-and-attacks/study-guide/ZcvQYEyowkyIYrjESpUp \"fv-autolink\") control barrier that lets only one person through at a time after they badge in. In AP Cybersecurity Unit 2, it's a defense against physical attacks where adversaries try to enter a restricted space behind an authorized person."}},{"@type":"Question","name":"Does a turnstile stop piggybacking?","acceptedAnswer":{"@type":"Answer","text":"Yes, that's its core purpose. Piggybacking relies on an attacker following an authorized person through a door, and a turnstile physically allows only one person per badge, so the attacker can't slip through."}},{"@type":"Question","name":"How is a turnstile different from an access control vestibule?","acceptedAnswer":{"@type":"Answer","text":"Both enforce one person at a time, but a turnstile is a single rotating or retracting gate you push through, while an [access control vestibule](/ap-cybersecurity/key-terms/access-control-vestibule \"fv-autolink\") is a small two-door room (a mantrap) where the second door stays locked until you're verified and the first door closes."}},{"@type":"Question","name":"Is a turnstile a technical control or a physical control?","acceptedAnswer":{"@type":"Answer","text":"It's a physical control. AP Cybersecurity stresses that physical access can defeat technical controls like passwords and firewalls (EK 2.2.C.1), so physical barriers like turnstiles are a separate, important layer of defense."}},{"@type":"Question","name":"Why does a turnstile matter for the AP Cybersecurity exam?","acceptedAnswer":{"@type":"Answer","text":"It's a go-to example for topic 2.2 questions that ask which control prevents a specific physical attack. You should be able to pair it with badge access and explain that it enforces one person per authorization to block tailgating."}}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"AP Cybersecurity","item":"https://fiveable.me/ap-cybersecurity"},{"@type":"ListItem","position":2,"name":"Key Terms","item":"https://fiveable.me/ap-cybersecurity/key-terms"},{"@type":"ListItem","position":3,"name":"Unit 2","item":"https://fiveable.me/ap-cybersecurity/unit-2"},{"@type":"ListItem","position":4,"name":"turnstile"}]}]}
```