The following are the purposes of creating a prototype:
1. It reduces initial project risks within a business organization.
2. It helps verify some of the application requirements that are not clearly defined by a user.
3. It confirms technology recommendations for an application.
4. It reduces the gap between what a developer has defined for an application architecture and what business management has understood.
5. It also reduces the gap between what a user has defined for an application requirement or scenario and what a developer has defined in the application development.

Continuous monitoring in any system takes place after initial system security accreditation.
It involves tracking changes to the information system that occur during its lifetime, and then determines the impact of those changes on the system security. Due to the necessary changes in hardware, software, and firmware during the lifetime of an information system, an evaluation of the results of these modifications has to be conducted to determine whether corresponding changes necessarily have to be made to security controls, to bring the system to the desired security state.
Continuous Monitoring is the fourth phase of the Security Certification and Accreditation process.
The Continuous Monitoring process involves the following three activities:
1. Configuration Management and Control
2. Security control monitoring and impact analysis of changes to the information system.
3. Status reporting and documentation
1. Configuration management and control: This activity involves the following functions:
o Documentation of information system changes
o Security impact analysis
2. Security control monitoring: This activity involves the following functions:
o Security control selection
o Selected security control assessment
3. Status reporting and documentation: This activity involves the following functions:
o System security plan update
o Plan of action and milestones update
o Status reporting
The objective of these tasks is to observe and evaluate the information system security controls during the system life cycle. These tasks determine whether the changes that have occurred will negatively impact the system security.
Answer option D is incorrect. It is not a valid activity.

The inner firewall is the one that protects the actual network from the outside world. Also it is usually necessary to allow far more users to connect to the web server than you allow into your actual network.
Answer option C is incorrect. The outer end of the DMZ must have less restrictions in order to allow a variety of outside users to connect to the web server.
Answer option A is incorrect. If you have a firewall on the web server itself, it should be consistent with the outer end of the DMZ.
Answer option D is incorrect. The inner end of the DMZ should be the most secure.

Perfect forward secrecy means that if an attacker discovers the material used to derive a key, that does not compromise previously generated keys. This is important as it prevents those keys from having to be replaced.
Answer option A is incorrect. An authentication protocol is any protocol used to verify the identity of a user or machine in network communications.
Answer option B is incorrect. Diffie-Hellman is a protocol for exchanging keys over an insecure medium.
Answer option D is incorrect. Key exchange protocols are only concerned with exchanging a symmetric key, not with the situation that might arise should the key derivation process become compromised.

Risk analysis provides the higher management the details necessary to determine the risks that should be mitigated, transferred, and accepted. It recognizes risks, quantifies the impact of threats, and supports budgeting for security. It adjusts the requirements and objectives of the security policy with the business objectives and motives. The following are the stages in the risk analysis process.
1. inventory
2. Threat assessment
3. Evaluation of control
4. Management
5. Monitoring