Section: Mixed questions
Explanation/Reference: https://books.google.com.pk/books?id=9gCn86CmsNQC&pg=PA570&lpg=PA570&dq=CISSP
+Directive+controls+are+a+form+of+change+management+policy+and+procedures.+Which+of+the
+following+subsections+are+recommended+as+part+of+the+change+management
+process&source=bl&ots=riGvVpSS3E&sig=ACfU3U3dLYheW_GfTZcAYfN97fnDFlMmZg&hl=en&sa=X&v ed=2ahUKEwjukoqK96npAhULtRoKHZEpBmcQ6AEwAHoECBQQAQ#v=onepage&q=CISSP%20Directive
%20controls%20are%20a%20form%20of%20change%20management%20policy%20and%20procedures.
%20Which%20of%20the%20following%20subsections%20are%20recommended%20as%20part%20of%
20the%20change%20management%20process&f=false

The formula ALE = ARO x SLE involves numerical values or quantities of a given
resource or occurrence so it is thus a quantitative analysis.
ALE = Annual Lose expectancy or how much it might cost per year if you were to lose the asset
ARO = Annual Rate of Occurrence or how often the loss might occur.
SLE = Single Loss Expectancy or how much each incident of loss would cost the organization.
Using these values you can determine how much you should spend to secure the resources
against loss.
It is useful to use these costs when we compare them to the value of the asset for which we are responsible.
It wouldn't be sensible to spend $10,000 USD a year for an asset you could replace for $2,000 USD.
The following answers are incorrect:
-Qualitative Analysis: This is part of the risk analysis process where interviews are conducted with employees to determine risk and where focus should be made for protecting assets. Many analysts combine Quantitative and Qualitative risk assessments to form an effective picture of where dollars should be spent to secure critical resources for the organization. It is not a correct answer because it does not use a mathematical formula to determine a hard value.
-Objective Analysis: This is not a commonly used term to describe an approach to risk analysis but an objective approach could be likened more to a quantitative analysis where specific values are determined in the risk analysis process.
-Expected Loss Analysis: This is also not a common term in risk analysis but it could describe the concept of analysis an expected loss due to a threat for which you must plan.
The following reference(s) was used to create this question:
Gregg, Michael; Haines, Billy (2012-02-16). CASP: CompTIA Advanced Security Practitioner Study Guide Authorized Courseware: Exam CAS-001 (p. 215). Wiley. Kindle Edition.

Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide:
Mastering the Ten Domains of Computer Security, page 222.
"System crash" and "system failure" are the key words. One "recovers" from a crash or failure.

The security kernel implements the reference model concept. The reference model must have the following characteristics: It must mediate all accesses. It must be protected from modification. It must be verifiable as correct. Answer "the authorization database" is used by the reference monitor to mediate accesses by subjects to objects. When a request for access is received, the reference monitor refers to entries in the authorization database to verify that the operation requested by a subject for application to an object is permitted. The authorization database has entries or authorizations of the form subject, object, access mode.
In answer "Identification and authentication (I & A) mechanisms", the I & A operation is separate from the reference monitor. The user enters his/her identification to the I & A function. Then the user must be authenticated. Authentication is verification that the user's claimed identity is valid. Authentication is based on the following three factor types: Type 1. Something you know, such as a PIN or password Type 2. Something you have, such as an ATM card or smart card Type 3. Something you are (physically), such as a fingerprint or retina scan
Answer "The auditing subsystem" is a key complement to the reference monitor. The auditing subsystem is used by the reference monitor to keep track of the reference monitor's activities. Examples of such activities include the date and time of an access request, identification of the subject and objects involved, the access privileges requested and the result of the request.