Secondary evidence is a copy of evidence or oral description of its contents; not as
reliable as best evidence
Here are other types of evidence:
Best evidence - original or primary evidence rather than a copy of duplicate of the evidence
Direct evidence - proves or disproves a specific act through oral testimony based on information
gathered through the witness's five senses
Conclusive evidence - incontrovertible; overrides all other evidence
Opinions - two types: Expert - may offer an opinion based on personal expertise and facts,
Non-expert - may testify only as to facts
Circumstantial evidence - inference of information from other, immediate, relevant facts
Corroborative evidence - supporting evidence used to help prove an idea or point; used as a
supplementary tool to help prove a primary piece of evidence
Hearsay evidence (3rdparty) - oral or written evidence that is presented in court that is second
hand and has no firsthand proof of accuracy or reliability
(i)
Usually not admissible in court
(ii)
Computer generated records and other business records are in hearsay category
(iii) Certain exceptions to hearsay rule:
(1)
Made during the regular conduct of business and authenticated by witnesses familiar with their use
(2)
Relied upon in the regular course of business
(3)
Made by a person with knowledge of records
(4)
Made by a person with information transmitted by a person with knowledge
(5)
Made at or near the time of occurrence of the act being investigated
(6)
In the custody of the witness on a regular basis Reference:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 310.
and
CISSP for Dummies, Peter Gregory, page 270-271

X.509 was initially issued on July 3, 1988 and was begun in association with the
X.500 standard.
It assumes a strict hierarchical system of certificate authorities (CAs) for issuing the certificates.
This contrasts with web of trust models, like PGP, where anyone (not just special CAs) may sign
and thus attest to the validity of others' key certificates.
PKI establishes a level of trust within an environment.
PKI is an ISO authentication framework that uses public key cryptography and the X.509 standard.
The framework was set up to enable authentication to happen across different networks and the
Internet.
Particular protocols and algorithms are not specified, which is why PKI is called a framework and
not a specific technology.
In cryptography, X.509 is an ITU-T standard for a public key infrastructure (PKI) and Privilege
Management Infrastructure (PMI). X.509 specifies, amongst other things, standard formats for
public key certificates, certificate revocation lists, attribute certificates, and a certification path
validation algorithm.
The standard for how the CA creates the certificate is X.509, which dictates the different fields
used in the certificate and the valid values that can populate those fields.
The most commonly used version is v3 of this standard, which is often denoted as X.509v3.
Many cryptographic protocols use this type of certificate, including SSL.
The certificate includes the serial number, version number, identity information, algorithm information, lifetime dates, and the signature of the issuing authority
The following answers are incorrect:
X.500 is a Directory Access Protocol(LDAP)
X.400 is for Electronic Messaging (EMAILs)
X.25 is Frame Relay
The following reference(s) were/was used to create this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 833). McGraw-Hill .
Kindle Edition.

The Layer Two Tunneling Protocol (L2TP) is a layer two tunneling protocol that allows a host to establish a virtual connection. Although L2TP, an enhancement to Layer Two Forwarding Protocol (L2F) and supporting some features of Point to Point Tunneling Protocol (PPTP), may coexist with IPSec, it is not natively an IPSec component. Answer a, the Authentication Header (AH), is an authenticating protocol that uses a hash signature in the packet header to validate the integrity of the packet data and the authenticity of the sender.
*the Security Association (SA), is a component of the IPSec architecture that contains
the information the IPSec device needs to process incoming and outbound IPSec packets. IPSec devices embed a value called the Security Parameter Index (SPI) in the header to associate a datagram with its SA, and store SAs in a Security Association Database (SAD).
*the Encapsulating Security Payload (ESP), is an authenticating and encrypting protocol that provides integrity, source authentication, and confidentiality services. Source: Implementing IPSec by Elizabeth Kaufman and Andrew Newman (Wiley, 1999).

DAC - Discretionary Access Control is where the user controls access to the data they create or manage.
It is the least secure method of access control because of a few factors:
- Employee changeover can lead to confusion of data ownership or abandoned data.
- Employees are not traditionally experienced enough to manage data permissions and maintain them in a reliable fashion.
- People in general are the least reliable component of any organization
The following answers are incorrect:
- MAC - Mandatory Access Control: This is incorrect because in the MAC model of access control, labels are used to identify the level of sensitivity of the data. If the user does not have privileges to such data he or she is denied access.
- RBAC - Role-Based Access Control: Sorry, RBAC is Role-Based Access Control where the users' Role determines the access level to data they are given.
- NDAC - Non-Discretionary Access Control: Sorry, this isn't a common term associated with access control methodologies.
The following reference(s) was used to create this question:
2013 Official Security+ Curriculum.

Anything based on a fixed IP address would be a problem for mobile users because their location and its associated IP address can change from one time to the next.
Many providers will assign a new IP every time the device would be restarted. For example an insurance adjuster using a laptop to file claims online. He goes to a different client each time and the address changes every time he connects to the ISP.
NOTE FROM CLEMENT:
The term MOBILE in this case is synonymous with Road Warriors where a user is contantly traveling and changing location. With smartphone today that may not be an issue but it would be an issue for laptops or WIFI tablets. Within a carrier network the IP will tend to be the same and would change rarely. So this question is more applicable to devices that are not cellular devices but in some cases this issue could affect cellular devices as well.
The following answers are incorrect:
mechanism with reusable password. This is incorrect because reusable password mechanism would not present a problem for mobile users. They are the least secure and change only at specific interval.
one-time password mechanism. This is incorrect because a one-time password mechanism would not present a problem for mobile users. Many are based on a clock and not on the IP address of the user.
challenge response mechanism. This is incorrect because challenge response mechanism would not present a problem for mobile users.