Comprehensive and Detailed In-Depth Explanation:
The Three Lines of Defense Model classifies risk management roles as follows:
First Line of Defense: Operational management responsible for risk controls (e.g., blocking unauthorized traffic, encrypting data).
Second Line of Defense: Risk management and compliance functions that monitor and assess the effectiveness of first-line controls (e.g., reviewing disaster recovery test results).
Third Line of Defense: Independent audit functions providing assurance (e.g., conducting security assessments).
Option C (Reviewing disaster recovery test results) aligns with the second line of defense because it involves oversight and evaluation of IT controls rather than direct execution.
Reference: IIA Three Lines Model - Risk Management

Comprehensive and Detailed In-Depth Explanation:
Biometric authentication (e.g., fingerprint, retina scan) is the most difficult to revoke because it is linked to an individual's physical attributes, which cannot be changed like passwords or physical devices.
Option A (Traditional key lock) - Can be revoked by retrieving the key or changing the lock.
Option C (Card-key system) - Can be revoked by deactivating the card.
Option D (Proximity device) - Can be revoked by disabling the device.
Since biometric data is permanently tied to an individual, revoking access is complex, making Option B the correct answer.
Reference: IIA IT Security & Authentication Controls