Reference: pg 46 Krutz: CISSP Prep Guide: Gold Edition

A rate-of-rise detector triggers an alarm
when the ambient temperature of a room increases rapidly. Another
type of heat-sensing detector, a fixed temperature device, sends an
alarm when the temperature passes a predetermined level.

Explanation/Reference:
Explanation:
Trusted recovery ensures that security is not breached when a system crash or other system failure (sometimes called a "discontinuity") occurs. It must ensure that the system is restarted without compromising its required protection scheme, and that it can recover and rollback without being compromised after the failure. Trusted recovery is required only for B3 and A1 level systems. A system failure represents a serious security risk because the security controls may be bypassed when the system is not functioning normally.
For example, if a system crashes while sensitive data is being written to a disk (where it would normally be protected by controls), the data may be left unprotected in memory and may be accessible by unauthorized personnel.
Trusted recovery has two primary activities - preparing for a system failure and recovering the system.
Incorrect Answers:
B: Hot swappable refers to computer components that can be swapped while the computer is running. This is not what is described in the question.
C: Redundancy refers to multiple instances of computer or network components to ensure that the system can remain online in the event of a component failure. This is not what is described in the question.
D: Secure Boot refers to a security standard that ensures that a computer boots using only software that is trusted. This is not what is described in the question.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP Prep Guide: Mastering the CISSP and ISSEP Exams, 2nd Edition, Wiley Publishing, Indianapolis, 2004, p. 310

Tokens are usually used to provide authentication through "What we have", is most commonly implemented to provide two-factor authentication. For example, SecurID requires two pieces of information, a password and a token. The token is usually generated by the SecurID token - a small electronic device that users keep with them that display a new number every 60 seconds. Combining this number with the users password allows the SecurID server to determine whatever or not the user should be granted access.

A HIDS does not consume large amounts of system resources is the correct choice. HIDS can consume inordinate amounts of CPU and system resources in order to function effectively, especially during an event.
All the other answers are characteristics of HIDSes
A HIDS can:
- scrutinize event logs, critical system files, and other auditable system resources;
- look for unauthorized change or suspicious patterns of behavior or activity
- can send alerts when unusual events are discovered
Reference:
Official guide to the CISSP CBK. Pages 197 to 198.