Achecksum that is derived from a Kerberos message is used to verify
the integrity of the message. This checksum may be a message digest
resulting from the application of a hash function to the message. At the receiving end of the transmission, the receiving party can calculate the message digest of the received message using the identical hash algorithm as the sender. Then the message digest calculated by the receiver can be compared with the message digest appended to the message by the sender. If the two message digests match, the message has not been
modified en route, and its integrity has been preserved.
For answers Credentials and Tickets are authenticators used in the process of granting user access to services on the network. Answer "A trusted, third-party authentication server" is the AS or authentication server that conducts the ticket-granting process.

Log retention is the practice of keeping log data for a certain period of time. It ensures that old log data is not overwritten, and it can be used for analysis, troubleshooting, and compliance purposes. The retention period can be set according to the organization's needs, and it can be defined as a number of days, weeks, or months.

The Bell-LaPadula model is a formal model dealing with confidentiality.
The Bell-LaPadula Model (abbreviated BLP) is a state machine model used for enforcing access
control in government and military applications. It was developed by David Elliott Bell and Leonard
J. LaPadula, subsequent to strong guidance from Roger R. Schell to formalize the U.S. Department of Defense (DoD) multilevel security (MLS) policy. The model is a formal state transition model of computer security policy that describes a set of access control rules which use security labels on objects and clearances for subjects. Security labels range from the most sensitive (e.g."Top Secret"), down to the least sensitive (e.g., "Unclassified" or "Public").
The Bell-LaPadula model focuses on data confidentiality and controlled access to classified
information, in contrast to the Biba Integrity Model which describes rules for the protection of data
integrity. In this formal model, the entities in an information system are divided into subjects and
objects.
The notion of a "secure state" is defined, and it is proven that each state transition preserves
security by moving from secure state to secure state, thereby inductively proving that the system
satisfies the security objectives of the model. The Bell-LaPadula model is built on the concept of a
state machine with a set of allowable states in a computer network system. The transition from
one state to another state is defined by transition functions.
A system state is defined to be "secure" if the only permitted access modes of subjects to objects
are in accordance with a security policy. To determine whether a specific access mode is allowed,
the clearance of a subject is compared to the classification of the object (more precisely, to the
combination of classification and set of compartments, making up the security level) to determine if
the subject is authorized for the specific access mode.
The clearance/classification scheme is expressed in terms of a lattice. The model defines two
mandatory access control (MAC) rules and one discretionary access control (DAC) rule with three
security properties:
The Simple Security Property - a subject at a given security level may not read an object at a
higher security level (no read-up).
The -property (read "star"-property) - a subject at a given security level must not write to any
object at a lower security level (no write-down). The -property is also known as the Confinement
property.
The Discretionary Security Property - use of an access matrix to specify the discretionary access
control.
The following are incorrect answers:
Accountability is incorrect. Accountability requires that actions be traceable to the user that
performed them and is not addressed by the Bell-LaPadula model.
Integrity is incorrect. Integrity is addressed in the Biba model rather than Bell-Lapadula.
Availability is incorrect. Availability is concerned with assuring that data/services are available to
authorized users as specified in service level objectives and is not addressed by the Bell-Lapadula
model.
References:
CBK, pp. 325-326
AIO3, pp. 279 - 284
AIOv4 Security Architecture and Design (pages 333 - 336) AIOv5 Security Architecture and Design (pages 336 - 338) Wikipedia at https://en.wikipedia.org/wiki/Bell-La_Padula_model

Kerberos depends on secret keys (symmetric ciphers). Kerberos is a third party
authentication protocol. It was designed and developed in the mid 1980's by MIT. It is considered
open source but is copyrighted and owned by MIT. It relies on the user's secret keys. The
password is used to encrypt and decrypt the keys.
The following answers are incorrect:
It utilizes public key cryptography. Is incorrect because Kerberos depends on secret keys
(symmetric ciphers).
It encrypts data after a ticket is granted, but passwords are exchanged in plain text. Is incorrect
because the passwords are not exchanged but used for encryption and decryption of the keys.
It is a second party authentication system. Is incorrect because Kerberos is a third party
authentication system, you authenticate to the third party (Kerberos) and not the system you are
accessing.
References:
MIT http://web.mit.edu/kerberos/
Wikipedi http://en.wikipedia.org/wiki/Kerberos_%28protocol%29
OIG CBK Access Control (pages 181 - 184)
AIOv3 Access Control (pages 151 - 155)