There are different types of access control. Access controls can be categorized as
follows:
Preventive (in order to avoid occurrence)
Detective (in order to detect or identify occurrences)
Deterrent (in order to discourage occurrences)
Corrective (In order to correct or restore controls)
Recovery (in order to restore resources, capabilities, or losses)

Explanation/Reference:
Explanation:
A covert channel is a way for an entity to receive information in an unauthorized manner. It is an information flow that is not controlled by a security mechanism.
Covert channels are of two types: storage and timing.
A covert storage channel involves direct or indirect reading of a storage location by another process. A covert timing channel depends upon being able to influence the rate that some other process is able to acquire resources, such as the CPU.
A covert storage channel is a "covert channel that involves the direct or indirect writing of a storage location by one process and the direct or indirect reading of the storage location by another process.
Covert storage channels typically involve a finite resource (e.g. sectors on a disk) that is shared by two subjects at different security levels.
A covert timing channel is a "covert channel in which one process signals information to another by modulating its own use of system resources (e.g. CPU time) in such a way that this manipulation affects the real response time observed by the second process
Incorrect Answers:
B: Software and Timing are not defined types of covert channels.
C: Kernel is not a defined type of covert channel.
D: Kernel is not a defined type of covert channel.
References:
http://www.isg.rhul.ac.uk/~prai175/ISGStudentSem07/CovertChannels.ppt
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 378-379

Explanation/Reference:
Explanation:
Kerberos addresses the confidentiality and integrity of information. It does not directly address availability and attacks such as frequency analysis. Furthermore, because all the secret keys are held and authentication is performed on the Kerberos TGS and the authentication servers, these servers are vulnerable to both physical attacks and attacks from malicious code. Replay can be accomplished on Kerberos if the compromised tickets are used within an allotted time window. Because a client's password is used in the initiation of the Kerberos request for the service protocol, password guessing can be used to impersonate a client.
Incorrect Answers:
A: Kerberos does not use a private key like an asymmetric key cryptography system does. It uses symmetric key cryptography (shared key).
B: Kerberos does not use a public key like an asymmetric key cryptography system does. It uses symmetric key cryptography (shared key).
D: KSD being compromised is not a vulnerability of Kerberos.
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP and CAP Prep Guide: Mastering CISSP and CAP, Wiley Publishing, Indianapolis, 2007, p. 78

Confidentiality is the opposite of disclosure.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 59.

Organizations usually forgive a particular type, number, or pattern of violations, thus permitting a predetermined number of user errors before gathering this data for analysis. An organization attempting to track all violations, without sophisticated statistical computing ability, would be unable to manage the sheer quantity of such data. To make a violation listing effective, a
clipping level must be established.
The clipping level establishes a baseline for violation activities that may be normal user errors.
Only after this baseline is exceeded is a violation record produced. This solution is particularly
effective for small- to medium-sized installations. Organizations with large-scale computing
facilities often track all violations and use statistical routines to cull out the minor infractions (e.g.,
forgetting a password or mistyping it several times).
If the number of violations being tracked becomes unmanageable, the first step in correcting the
problems should be to analyze why the condition has occurred. Do users understand how they are
to interact with the computer resource? Are the rules too difficult to follow? Violation tracking and
analysis can be valuable tools in assisting an organization to develop thorough but useable
controls. Once these are in place and records are produced that accurately reflect serious
violations, tracking and analysis become the first line of defense. With this procedure, intrusions
are discovered before major damage occurs and sometimes early enough to catch the perpetrator.
In addition, business protection and preservation are strengthened.
The following answers are incorrect:
All of the other choices presented were simply detractors.
The following reference(s) were used for this question:
Handbook of Information Security Management