The administrator must specify APM access control entries as either L4 or L7.

True is incorrect because APM does not impose a rule requiring each access control entry to be explicitly typed as either L4 or L7; access policy logic is abstracted above that mandatory designation.

APM access control entries in the Visual Policy Editor are not constrained to a mandatory L4 or L7 classification by the administrator. APM evaluates access based on session variables, user identity, endpoint checks, and resource assignments rather than a required per-entry layer designation. The policy engine handles layer context internally, so forcing an explicit L4/L7 declaration on every ACE is not an APM requirement.