Drupal - What's the difference between access arguments and access callback?

"Access callback" is the function that is called to verify the user has access to the page. As special case, it could be the value TRUE, and in that case all users would have access to it; in other words, the access permission would be bypassed.

In the case you are using a function name for the "access callback" value (by default, it's "user_access"), then you can also use "access arguments", which is an array containing the arguments passed to the access callback function.
As with other menu callbacks, the arguments must be a string, or a number; in the case it's a number, the value will be replaced with a value taken from the menu path. If you want to avoid this replacement, instead of a number you need to use a string; for example, using "1" as one for the arguments passed to the access callback would avoid the automatic replacement.

These are some example of menu callback declarations used from Drupal core modules. (The examples are from Drupal 7 code, but for what I want to point out, that doesn't make any difference.)

This is an example where the access callback is user_access().

  $items['file/progress'] = array(
    'page callback' => 'file_ajax_progress', 
    'delivery callback' => 'ajax_deliver', 
    'access arguments' => array('access content'), 
    'theme callback' => 'ajax_base_page_theme', 
    'type' => MENU_CALLBACK,
  );

This is an example where the access callback is not a function name.

  $items['user'] = array(
    'title' => 'User account', 
    'title callback' => 'user_menu_title', 
    'page callback' => 'user_page', 
    'access callback' => TRUE, 
    'file' => 'user.pages.inc', 
    'weight' => -10, 
    'menu_name' => 'user-menu',
  );

In this case, the access callback is user_view_access() to which is passed, not the number 1, but a value taken from the menu path (which in this case is "user/%user"); this is a particular case, as the function will get the value returned by user_load().

  $items['user/%user'] = array(
    'title' => 'My account', 
    'title callback' => 'user_page_title', 
    'title arguments' => array(1), 
    'page callback' => 'user_view_page', 
    'page arguments' => array(1), 
    'access callback' => 'user_view_access', 
    'access arguments' => array(1),
    // By assigning a different menu name, this item (and all registered child
    // paths) are no longer considered as children of 'user'. When accessing the
    // user account pages, the preferred menu link that is used to build the
    // active trail (breadcrumb) will be found in this menu (unless there is
    // more specific link), so the link to 'user' will not be in the breadcrumb. 
    'menu_name' => 'navigation',
  );

Suppose the previous menu were defined as follows, and invoked with a path like "user/hello."

  $items['user/%'] = array(
    'title' => 'My account', 
    'title callback' => 'user_page_title', 
    'title arguments' => array(1), 
    'page callback' => 'user_view_page', 
    'page arguments' => array(1), 
    'access callback' => 'user_view_access', 
    'access arguments' => array(1),
    // By assigning a different menu name, this item (and all registered child
    // paths) are no longer considered as children of 'user'. When accessing the
    // user account pages, the preferred menu link that is used to build the
    // active trail (breadcrumb) will be found in this menu (unless there is
    // more specific link), so the link to 'user' will not be in the breadcrumb. 
    'menu_name' => 'navigation',
  );

In this case, the access callback would have received as argument the value taken from the path (0 means "user," and 1 means the part after "user" and the slash); in this case, that value is "hello."

To better understand these wildcard arguments, see Wildcard Loader Arguments. The documentation page is tagged Drupal 6, but what reported is still valid for Drupal 7.

Access callback is a function that examines if some user has some permissions. The default access callback is user_access()

Access arguments lists permission those are examined by access callback. e.g. "access contents"