It is the systems auditor that should lead the effort to ensure that the security controls are in place and effective. The audit would verify that the controls comply with polices, procedures, laws, and regulations where applicable. The findings would provide these to senior management.
The following answers are incorrect: the local security specialist. Is incorrect because an independent review should take place by a third party. The security specialist might offer mitigation strategies but it is the auditor that would ensure the effectiveness of the controls the business manager. Is incorrect because the business manager would be responsible that the controls are in place, but it is the auditor that would ensure the effectiveness of the controls the central security manager. Is incorrect because the central security manager would be responsible for implementing the controls, but it is the auditor that is responsibe for ensuring their effectiveness.

Kerberos depends on secret keys (symmetric ciphers). Kerberos is a third party
authentication protocol. It was designed and developed in the mid 1980's by MIT. It is considered
open source but is copyrighted and owned by MIT. It relies on the user's secret keys. The
password is used to encrypt and decrypt the keys.
The following answers are incorrect:
It utilizes public key cryptography. Is incorrect because Kerberos depends on secret keys
(symmetric ciphers).
It encrypts data after a ticket is granted, but passwords are exchanged in plain text. Is incorrect
because the passwords are not exchanged but used for encryption and decryption of the keys.
It is a second party authentication system. Is incorrect because Kerberos is a third party
authentication system, you authenticate to the third party (Kerberos) and not the system you are
accessing.
References:
MIT http://web.mit.edu/kerberos/
Wikipedi http://en.wikipedia.org/wiki/Kerberos_%28protocol%29
OIG CBK Access Control (pages 181 - 184)
AIOv3 Access Control (pages 151 - 155)

It is usually responsible for maintaining and protecting the data.
The following answers are incorrect:
Data owner is usually a member of management , in charge of a specific business unit and is ultimately responsible for the protection and use of the information.
User is any individual who routinely uses the data for work-related tasks.
Security administrator's tasks include creating new system user accounts , implementing new security software.
References : Shon Harris AIO v3 , Chapter - 3: Security Management Practices , Pages :
99 - 103

As in the object-oriented paradigm, COM works with encapsulated
objects. Communications with a COM object are through an
interface contract between an object and its clients that defines the
functions that are available in the object and the behavior of the
object when the functions are calleD.
*Answer a sandbox, is an access
control-based protection mechanism. It is commonly applied to
restrict the access rights of mobile code that is downloaded from a
Web site as an applet. The code is set up to run in a sandbox that
blocks its access to the local workstations hard disk, thus preventing
the code from malicious activity. The sandbox is usually interpreted
by a virtual machine such as the Java Virtual MachinE.
*Answer BOM is a distracter.
* Spiral Model refers to the software development life cycle.