Preventive Technical Controls are the technical ways of restricting who or what can access system resources and what type of access is permitted. Its purpose is to protect the OS and other systems from unauthorized modification or manipulation. It is usually built into an operating system, or it can be a part of an application or program, or an add-on security package, or special components to regulate communication between computers. It also protects the integrity and availability by limiting the number of users and/or processes. These controls also protect confidential information from being disclosed to unauthorized persons.

The correct answer is "An algorithm used to determine the monetary impact of each occurrence of a threat". The Single Loss Expectancy (or Exposure) figure may be created as a result of a Business Impact Assessment
(BIA). The SLE represents only the estimated monetary loss of a single
occurrence of a specified threat event. The SLE is determined by
multiplying the value of the asset by its exposure factor. This gives
the expected loss the threat will cause for one occurrence.
Answer a describes the Exposure Factor (EF). The EF is expressed
as a percentile of the expected value or functionality of the asset to be lost due to the realized threat event. This figure is used to calculate the SLE, above.
Answer "An algorithm that expresses the annual frequency with which a
threat is expected to occur" describes the Annualized Rate of Occurrence (ARO).
This is an estimate of how often a given threat event may occur annually.
For example, a threat expected to occur weekly would have an
ARO of 52. A threat expected to occur once every five years has an
ARO of 1/5 or .2. This figure is used to determine the ALE.
Answer d describes the Annualized Loss Expectancy (ALE). The
ALE is derived by multiplying the SLE by its ARO. This value represents the expected risk factor of an annual threat event. This figure is then integrated into the risk management process.

Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings (see white-box testing). This method of test can be applied to virtually every level of software testing: unit, integration, system and acceptance. It typically comprises most if not all higher level testing, but can also dominate unit testing as well.
For your exam you should know the information below: Alpha and Beta Testing - An alpha version is early version is an early version of the application system submitted to the internal user for testing. The alpha version may not contain all the features planned for the final version. Typically software goes to two stages testing before it consider finished.The first stage is called alpha testing is often performed only by the user within the organization developing the software. The second stage is called beta testing, a form of user acceptance testing, generally involves a limited number of external users. Beta testing is the last stage of testing, and normally involves real world exposure, sending the beta version of the product to independent beta test sites or offering it free to interested user.
Pilot Testing - A preliminary test that focuses on specific and predefined aspect of a system. It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system. Proof of concept are early pilot tests - usually over interim platform and with only basic functionalities.
White box testing - Assess the effectiveness of a software program logic. Specifically, test data are
used in determining procedural accuracy or conditions of a program's specific logic path. However
testing all possible logical path in large information system is not feasible and would be cost
prohibitive, and therefore is used on selective basis only.
Black Box Testing - An integrity based form of testing associated with testing components of an
information system's "functional" operating effectiveness without regards to any specific internal
program structure. Applicable to integration and user acceptance testing.
Function/validation testing - It is similar to system testing but it is often used to test the
functionality of the system against the detailed requirements to ensure that the software that has
been built is traceable to customer requirements.
Regression Testing - The process of rerunning a portion of a test scenario or test plan to ensure
that changes or corrections have not introduced new errors. The data used in regression testing
should be same as original data.
Parallel Testing - This is the process of feeding test data into two systems - the modified system
and an alternative system and comparing the result.
Sociability Testing - The purpose of these tests is to confirm that new or modified system can
operate in its target environment without adversely impacting existing system. This should cover
not only platform that will perform primary application processing and interface with other system
but , in a client server and web development, changes to the desktop environment. Multiple
application may run on the users desktop, potentially simultaneously , so it is important to test the
impact of installing new dynamic link libraries (DLLs), making operating system registry or
configuration file modification, and possibly extra memory utilization.
The following answers are incorrect:
Parallel Testing - This is the process of feeding test data into two systems - the modified system
and an alternative system and comparing the result.
Regression Testing - The process of rerunning a portion of a test scenario or test plan to ensure
that changes or corrections have not introduced new errors. The data used in regression testing
should be same as original data.
Pilot Testing - A preliminary test that focuses on specific and predefined aspect of a system. It is
not meant to replace other testing methods, but rather to provide a limited evaluation of the
system. Proof of concept are early pilot tests - usually over interim platform and with only basic
functionalities
The following reference(s) were/was used to create this question: CISA review manual 2014 Page number 167 Official ISC2 guide to CISSP CBK 3rd Edition Page number 176

Explanation/Reference:
Explanation:
Anomaly Detection IDS learns about the normal activities and events on your system by watching and tracking what it sees. Once it has accumulated enough data about normal activity, it can detect abnormal and possibly malicious activities or events. There is a small risk that some non-harmful activity is classified as anomaly by mistake - false positives can occur.
Incorrect Answers:
A: A Pattern Matching IDS uses a signature database and attempts to match all monitored events to its contents. Only activities present in the database will be detected. There will be no false positives.
C: Host-based intrusion detection is not an IDS analysis method. It is a classification on information source.
A host - based IDS watches for questionable activity on a single computer system, especially by watching audit trails, event logs, and application logs.
D: Network-based intrusion detection is not an IDS analysis method. It is a classification on information course. Here the source is a network segment.
References:
Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 56

Answer Note is a distracter.
A method is the code that defines the actions an object performs in response to a messagE.
Behavior is the result exhibited by an object upon receipt of a message.