What does ACL stand for?
ACL stands for Access Control List. An ordered list of rules that permit or deny traffic or access by criteria such as address, port or user. Firewalls and routers check rules top-down, first match wins, with an implicit deny at the end; NTFS permissions are also ACLs.
An ACL is an ordered list of rules that permit or deny. On a router or firewall each rule matches traffic by source, destination, protocol and port; the device reads the list from the top, applies the first rule that matches and stops. Anything that matches no rule is dropped by the implicit deny at the end. On a file system, an ACL is the list attached to a file or folder that says which users and groups may read, write or change it.
ACL in practice: an example
A router ACL has two rules: permit TCP from the office subnet to the web server on port 443, then deny all traffic to that server. A request to port 443 from the office matches the first rule and passes. An attempt to reach port 22 on the same server falls through to the second rule and is dropped.
What ACL is confused with
ACL vs stateful firewall: what is the difference?
A basic ACL judges each packet separately. A stateful firewall remembers connections, so a reply is allowed because it belongs to a session that was permitted on the way out.
ACL vs NAT: what is the difference?
An ACL decides whether traffic may pass. NAT rewrites addresses. Routers often do both, and an ACL is also used to select which traffic gets translated. What NAT stands for
Which exams cover ACL?
ACL is on the official CompTIA acronym list for two of the four exams covered here.
- Network+ N10-009: 4.0 (Network Security); 5.0 (Network Troubleshooting).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A router ACL contains only the rule: permit TCP from any source to 10.0.0.5 port 443. What happens to a packet for 10.0.0.5 port 80?
- It is permitted by default
- It is dropped by the implicit deny
- It is redirected to port 443
- It is logged and then permitted
Show the answer
B. It is dropped by the implicit deny. A packet that matches no rule reaches the implicit deny at the end of the list. Nothing redirects or permits it automatically.
2. An ACL lists: 1) deny all traffic from 10.1.1.0/24, 2) permit host 10.1.1.50. Why can 10.1.1.50 not get through?
- Host rules are ignored by routers
- The first matching rule is applied and the deny comes first
- The mask is too short
- ACLs cannot contain two rules
Show the answer
B. The first matching rule is applied and the deny comes first. Rules are read from the top and the first match wins. The specific permit must be placed above the general deny.
Sources: NIST glossary: access control list; Microsoft Learn: Access control lists; NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.