How can a DevOps Engineer limit access to certain pages in the AEM Publish instance?

How can a DevOps Engineer limit access to certain pages in the AEM Publish instance?

• A. Use Access Control Lists for the authors
• B. Use Closed User Groups (CUGs)
• C. Use the security features of Adobe Drive
• D. Use the AEM External Login Module

Answer: (B)

Closed User Groups let you gate access to specific pages on the Publish instance by requiring membership in a specified user group. You assign the page (or a subtree) to one or more CUGs, and only authenticated users who belong to those groups can view the content—the rest, including anonymous users, are denied. This approach is ideal for public-facing sites where certain pages must be restricted without altering author permissions or broader system security. You configure CUGs in the page’s restrictions and ensure the relevant user groups exist in your directory. The other options don’t fit as well: ACLs on the authors control who can author content (not who can view published pages); Adobe Drive security is about client-file access, not per-page web access; and the External Login Module handles authentication providers rather than page-by-page access control.

Closed User Groups let you gate access to specific pages on the Publish instance by requiring membership in a specified user group. You assign the page (or a subtree) to one or more CUGs, and only authenticated users who belong to those groups can view the content—the rest, including anonymous users, are denied. This approach is ideal for public-facing sites where certain pages must be restricted without altering author permissions or broader system security. You configure CUGs in the page’s restrictions and ensure the relevant user groups exist in your directory. The other options don’t fit as well: ACLs on the authors control who can author content (not who can view published pages); Adobe Drive security is about client-file access, not per-page web access; and the External Login Module handles authentication providers rather than page-by-page access control.