"The operational assurance requirements specified in the Orange Book are as follows:
System Architecture System integrity Covert channel analysis Trusted facility management Trusted recovery"
Pg. 301 Krutz: The CISSP Prep Guide: Gold Edition

Section: Mixed questions
Explanation:
Some products installed on systems can also watch for input values that might result in buffer overflows, but the best countermeasure is proper programming. This means use bounds checking. If an input value is only sup-posed to be nine characters, then the application should only accept nine characters and no more.
Some languages are more susceptible to buffer overflows than others, so programmers should understand these issues, use the right languages for the right purposes, and carry out code review to identify buffer overflow vulnerabilities.

The only way to ensure accountability is if the subject is uniquely identified and
authenticated. Identification alone does not provide proof the user is who they claim to be. After
showing proper credentials, a user is authorized access to resources.
References:
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, McGraw-Hill/Osborne, 2002, Chapter
4: Access Control (page 126).

Explanation/Reference:
Explanation:
Sensitivity (Security) labels are attached to all objects; thus, every file, directory, and device has its own security label with its classification information. A user may have a security clearance of secret, and the data he requests may have a security label with the classification of top secret. In this case, the user will be denied (prevented) because his clearance is not equivalent or does not dominate (is not equal or higher than) the classification of the object.
The terms "security labels" and "sensitivity labels" can be used interchangeably.
Incorrect Answers:
B: Sensitivity labels are preventive, not detective, as the label may prevent the user or process from accessing the resource.
C: A compensating control is a data security measure that is designed to satisfy the requirement for some other security measure that is deemed too difficult or impractical to implement. Sensitive controls are preventive, not compensating.
D: Sensitivity labels have nothing to do with accuracy. They are preventive.
References:
Conrad, Eric, Seth Misenar and Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham,
2012, p. 222