Which describes an Access Control List (ACL)?

• A. A maintenance schedule for access devices.
• B. A type of encryption used for securing assets.
• C. A list specifying which users or groups have permission to access resources or areas.
• D. A protocol for authenticating identity at the door.

Answer: (C)

An Access Control List is a record that defines which individuals or groups are allowed to access a resource or area and what actions they may perform. It ties identities to permissions, so when a person tries to access something, the system checks the list to decide whether to allow or deny the access. For example, an ACL could grant read/write access to a file for the IT group, or allow entry to a restricted area only for security personnel during certain hours. This concept is about who is permitted to do what and where, not about keeping devices maintained, encrypting data, or authenticating a person at the door. Maintaining an ACL helps enforce least privilege by ensuring people can access only what they’re authorized to.