Explanation/Reference:
Explanation:
Biometrics is used for identification in physical controls and for authentication in logical controls. Physical controls are items put into place to protect facility, personnel, and resources. As a physical control, biometrics provides protection by identifying a person to see if that person is authorized to access a facility.
When a user is identified and granted physical access to a facility, biometrics can be used for authentication in logical controls to provide access to resources.
Controls are put into place to reduce the risk an organization faces, and they come in three main flavors:
administrative, technical, and physical. Administrative controls are commonly referred to as "soft controls" because they are more management-oriented. Examples of administrative controls are security documentation, risk management, personnel security, and training. Technical controls (also called logical controls) are software or hardware components, as in firewalls, IDS, encryption, identification and authentication mechanisms. And physical controls are items put into place to protect facility, personnel, and resources. Examples of physical controls are security guards, locks, fencing, and lighting.
Incorrect Answers:
A: Biometrics is used in logical controls.
B: Biometrics is used for identification in physical controls and for authentication in logical controls, not the other way round. Biometrics is used first as a physical control to identify a person to grant access to a facility, and then as a logical control to authenticate the user to provide access to resources.
D: Biometrics does have a role in logical controls.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 28 Krutz, Ronald L. and Russell Dean Vines, The CISSP Prep Guide: Mastering the CISSP and ISSEP Exams, 2nd Edition, Wiley Publishing, Indianapolis, 2004, p. 58

A firewall is a device that supports and enforces the company's network security policy. - Shon Harris All-in-one CISSP Certification Guide pg 412

The Business Impact Analysis (BIA) identifies time-critical aspects of the critical
business processes, and determines their maximum tolerable downtime. The BIA helps to Identify
organization functions, the capabilities of each organization unit to handle outages, and the priority
and sequence of functions and applications to be recovered, identify resources required for
recovery of those areas and interdependencies
In performing the Business Impact Analysis (BIA) it is very important to consider what the
dependencies are. You cannot bring a system up if it depends on another system to be
operational. You need to look at not only internal dependencies but external as well. You might not
be able to get the raw materials for your business so dependencies are very important aspect of a
BIA.
The BIA committee will not truly understand all business processes, the steps that must take
place, or the resources and supplies these processes require. So the committee must gather this
information from the people who do know- department managers and specific employees
throughout the organization. The committee starts by identifying the people who will be part of the
BIA data-gathering sessions. The committee needs to identify how it will collect the data from the
selected employees, be it through surveys, interviews, or workshops. Next, the team needs to
collect the information by actually conducting surveys, interviews, and workshops. Data points
obtained as part of the information gathering will be used later during analysis. It is important that
the team members ask about how different tasks- whether processes, transactions, or services,
along with any relevant dependencies- get accomplished within the organization.
The following answers are incorrect:
composition This is incorrect because it is not the best answer. While the make up of business
may be important, if you have not determined the dependencies first you may not be able to bring
the critical business processes to a ready state or have the materials on hand that are needed.
priorities This is incorrect because it is not the best answer. While the priorities of processes are
important, if you have not determined the dependencies first you may not be able to bring the
critical business processes to a ready state or have the materials on hand that are needed.
service levels This is incorrect because it is not the best answer. Service levels are not as
important as dependencies.
Reference(s) used for this question:
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Business
Continuity and Disaster Recovery Planning (Kindle Locations 188-191). . Kindle Edition.
and
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 18562-
18568). McGraw-Hill. Kindle Edition.

Section: Communication and Network Security