The role that is responsible for determining who has a need for the information when developing the entitlement review process is the data owner. The data owner is a person or entity that has the authority and accountability for the creation, classification, usage, and protection of the data or information within an organization. The data owner is responsible for determining who has a need for the information when developing the entitlement review process, by defining and approving the access rights and privileges of the data or information, based on the business needs and security requirements of the organization and the stakeholders. The entitlement review process is a process that verifies and validates the access rights and privileges of the data or information, to ensure that they are appropriate, necessary, and compliant with the organization's policies and standards. The entitlement review process can help to prevent or reduce the unauthorized, excessive, or inappropriate access to the data or information, as well as to identify and resolve any access issues or anomalies. The data owner is responsible for determining who has a need for the information when developing the entitlement review process, by ensuring that the access rights and privileges of the data or information are consistent and compatible with the data owner's objectives and expectations, as well as with the data owner's roles and responsibilities. Data Custodian, Database Administrator, or Information Technology (IT) Director are not the roles that are responsible for determining who has a need for the information when developing the entitlement review process, as they are more related to the implementation, maintenance, or management aspects of the data or information, rather than the authority or accountability aspects of the data or information. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Identity and Access Management, page 308; CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 5: Identity and Access Management, Question 5.9, page 220.

"The Land denial of service attack causes many older operating systems (such as Windows NT 4, Windows 95, and SunOS 4.1.4) to freeze and behave in an unpredictable manner. It works by creating an artificial TCP packet that has the SYN flag set. The attacker set the destination IP address to the address of the victim machine and the destination port to an open port on that machine. Next, the attacker set the source IP address and source port to the same values as the destination IP address and port. When the targeted host receives this unusual packet, the operating system doesn't know how to process it and freezes, crashes, or behaves in an unusual manner as a result." Pg 237 Tittel: CISSP Study Guide

IT auditors determine whether systems are in compliance with the security policies, procedures, standards, baselines, designs, architectures, management direction and other requirements" and "provide top company management with an independent view of the controls
that have been designed and their effectiveness."
"Information systems security professionals" is incorrect. Security professionals develop the
security policies and supporting baselines, etc.
"Data owners" is incorrect. Data owners have overall responsibility for information assets and
assign the appropriate classification for the asset as well as ensure that the asset is protected with
the proper controls.
"Data custodians" is incorrect. Data custodians care for an information asset on behalf of the data
owner.
References;
CBK, pp. 38 - 42.
AIO3. pp. 99 - 104

The Clipper Chip is a NSA designed tamperproof chip for encrypting data and it uses the SkipJack algorithm. Each Clipper Chip has a unique serial number and a copy of the unit key is stored in the database under this serial number. The sending Clipper
Chip generates and sends a Law Enforcement Access Field (LEAF) value included in the transmitted message. It is based on a 80-bit key and a 16-bit checksum.
Source: WALLHOFF, John, CBK#5 Cryptography (CISSP Study Guide), April 2002 (page
1).

Unfortunately, anomaly detectors and the Intrusion Detection Systems (IDS) based on them often produce a large number of false alarms, as normal patterns of user and system behavior can vary wildly. Being only able to identify correctly attacks they already know about is a characteristic of misuse detection (signature-based) IDSs. Application-based IDSs are a special subset of host-based IDSs that analyze the events transpiring within a software application. They are more vulnerable to attacks than host-based IDSs. Not being able to identify abnormal behavior would not cause false positives, since they are not identified. Source: DUPUIS, Cl?ment, Access Control Systems and Methodology CISSP Open Study Guide, version 10, march 2002 (page 92).