The correct answer is "Non-mandated policies, but strongly suggested". Advisory policies might have consequences of failure attached to them, but they are still considered nonmandatory.
The other three answers are examples of mandatory,
regulatory policies.

The application firewall (proxy) relays the traffic from a trusted host running a specific application to an untrusted server. It will appear to the untrusted server as if the request originated from the proxy server.
"Data's payload" is incorrect. Only the origin is changed.
"Data's details" is incorrect. Only the origin is changed.
"Data's owner" is incorrect. Only the origin is changed.
References:
CBK, p. 467
AIO3, pp. 486 - 490

User access review and adjustment is the action that should be triggered within the identity and access management (IAM) lifecycle when an employee transfers from one role to another. IAM is the process of identifying, authenticating, authorizing, and managing the users and their access rights to the organization's resources and systems. The IAM lifecycle consists of four phases: provisioning, maintenance, review, and deprovisioning. When an employee transfers from one role to another, their access rights may need to be changed or updated to reflect their new responsibilities and duties. This requires a user access review and adjustment, which is part of the maintenance phase of the IAM lifecycle. User access review and adjustment involves verifying and validating the user's identity and current access rights, and modifying or revoking the access rights as needed, based on the principle of least privilege and the organization's policies and standards.
The other options are not correct. New account creation is part of the provisioning phase of the IAM lifecycle, and it is not necessary when an employee transfers from one role to another, unless the employee needs to access a new system or resource that requires a separate account. Deprovisioning is part of the deprovisioning phase of the IAM lifecycle, and it involves deleting or disabling the user's account and access rights when the user leaves the organization or no longer needs access to the system or resource. System account access review and adjustment is not a specific action within the IAM lifecycle, although it may be part of the user access review and adjustment process, if the user has access to system accounts or privileges. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Communication and Network Security, page 615. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 5: Communication and Network Security, page 616.

Explanation/Reference:
Explanation:
A Business Impact Assessment (BIA) is an analysis that identifies the resources that are critical to an organization's ongoing viability and the threats posed to those resources. It also assesses the likelihood that each threat will actually occur and the impact those occurrences will have on the business.
Identification of priorities is the first step of the business impact assessment process.
Incorrect Answers:
B: Current State Assessment is related to future business planning needs. It is concerned with recovery time of critical business processes.
C: Risk Mitigation Assessment is concerned with recovery time objectives. The Business Impact Assessment addresses the recovery time.
D: Business Risk Assessment is concerned with recovery time objectives. The Business Impact Assessment addresses the recovery time.
References:
Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 825

Explanation/Reference:
Explanation:
Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), both of which are frequently referred to as 'SSL', are cryptographic protocols designed to provide communications security over a computer network.
The connection is reliable because each message transmitted includes a message integrity check using a message authentication code to prevent undetected loss or alteration of the data during transmission.
A message authentication code (MAC) is a short piece of information used to authenticate a message-in other words, to provide integrity and authenticity assurances on the message. Integrity assurances detect accidental and intentional message changes, while authenticity assurances affirm the message's origin.
A MAC algorithm, sometimes called a keyed (cryptographic) hash function (however, cryptographic hash function is only one of the possible ways to generate MACs), accepts as input a secret key and an arbitrary-length message to be authenticated, and outputs a MAC (sometimes known as a tag). The MAC value protects both a message's data integrity as well as its authenticity, by allowing verifiers (who also possess the secret key) to detect any changes to the message content.
Incorrect Answers:
A: Secure Sockets Layer (SSL) does not use a Message Authentication Code (MAC) for message non- repudiation.
B: Secure Sockets Layer (SSL) does not use a Message Authentication Code (MAC) for message confidentiality; it uses symmetric cryptography for that.
C: Secure Sockets Layer (SSL) does not use a Message Authentication Code (MAC) for message interleave checking.
References:
https://en.wikipedia.org/wiki/Transport_Layer_Security
https://en.wikipedia.org/wiki/Message_authentication_code