I have no specific reference for this question but the major resources hammer that there needs to be methods to check the data for correctness.

Risk analysis is the process of identifying, assessing, and prioritizing the risks that could affect an organization's assets, operations, or objectives. Risk analysis is an essential component of Disaster Recovery (DR) planning, as it helps to determine the likelihood and impact of various disaster scenarios, and to develop appropriate mitigation and recovery strategies. The main objective of risk analysis in DR planning is to identify potential threats to business availability, which is the ability of an organization to continue its critical business functions and processes in the event of a disaster. Business availability depends on the availability of the information systems (IS) that support the business functions and processes, such as hardware, software, data, network, and personnel. Risk analysis helps to identify the vulnerabilities and threats that could compromise the availability of the IS, and to estimate the potential losses and damages that could result from a disaster. Risk analysis also helps to establish the recovery point objective (RPO), which is the maximum acceptable amount of data loss after a disaster, and the recovery time objective (RTO), which is the maximum acceptable time to restore the normal operations after a disaster. References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 7: Security Operations, page 330. [CISSP All-in-One Exam Guide, Eighth Edition], Chapter 8: Business Continuity and Disaster Recovery Planning, page 461.

Explanation/Reference:
Explanation:
In e-mail clients SMTP works as a message transfer agent and moves the message from the user's computer to the mail server when the user sends the e-mail message.
Incorrect Answers:
B: SNMP is used for monitoring the network, not for sending email messages.
C: S-RPC is used for remote procedure not calls, and not for sending email messages.
D: S/MIME is a standard for email encryption. It is not used to send email messages.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 599

The NIACAP provides a standard set of activities, general tasks, and
a management structure to certify and accredit systems that will maintain the information assurance and security posture of a system or site.
The NIACAP is designed to certify that the information system meets
documented accreditation requirements and will continue to maintain
the accredited security posture throughout the system life cycle.
* Answer CIAP is being developed for the evaluation of critical commercial systems and uses the NIACAP methodology.
* DITSCAP establishes for the defense entities a standard process, set of activities, general task descriptions, and a management structure to certify and accredit IT systems that will maintain the required security posture. The process is designed to certify that the IT system meets the accreditation requirements and that the system will maintain the accredited security posture throughout the system life cycle. The four phases to the DITSCAP are Definition, Verification, Validation, and
Post Accreditation.
* Answer "Defense audit" is a distracter.