ICMP = 1 IGMP = 2 TCP = 6 UDP = 17
Pg. 55 Casad: Sams Teach Yourself TCP/IP in 24 hrs.

Accreditation: is an administrative declaration by a designated authority that an information system is approved to operate in a particular security configuration with a prescribed set of safeguards. It is usually based on a technical certification of the system's security mechanisms.
Certification: Technical evaluation (usually made in support of an accreditation action) of an information system\'s security features and other safeguards to establish the extent to which the system\'s design and implementation meet specified security requirements.
Source: SHIREY, Robert W., RFC2828: Internet Security Glossary, may 2000.

The best way to prevent and detect software license violations is to regularly scan
used PCs, either from the LAN or directly, to ensure that unauthorized copies of software have not
been loaded on the PC.
Other options are not detective.
A corporate policy is not necessarily enforced and followed by all employees.
Software can be installed from other means than floppies or CD-ROMs (from a LAN or even
downloaded from the Internet) and software metering only concerns applications that are
registered.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor
2002 review manual, Chapter 3: Technical Infrastructure and Operational Practices (page 108).

Cost-Benefit Analysis (CBA) is a method of comparing the costs and benefits of a security initiative, such as implementing a new security control, upgrading an existing security system, or conducting a security audit.
CBA helps to determine the feasibility, viability, and desirability of a security initiative, and to support the decision-making process. The result of CBA on a new security initiative provides quantifiable justification, which means that the benefits of the initiative outweigh the costs, and that the initiative is worth pursuing.
Quantifiable justification can be expressed in terms of return on investment (ROI), net present value (NPV), or internal rate of return (IRR), which are financial metrics that measure the profitability and efficiency of a security initiative. CBA does not provide baseline improvement, which is the process of measuring and enhancing the current performance of a security system or a process. CBA does not provide risk evaluation, which is the process of identifying, analyzing, and prioritizing the risks that could affect a security system or a process. CBA does not provide formalized acceptance, which is the process of obtaining the approval and the support of the stakeholders for a security initiative. References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 1: Security and Risk Management, page 26. CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, page 39.

When a user accesses a Web page through a browser, class files for
an applet are downloaded automatically, even from untrusted
sources. To counter this possible threat, Java provides a
customizable sandbox to which the applets' execution is confined.
This sandbox provides such protections as preventing reading and
writing to a local disk, prohibiting the creation of a new process,
prevention of making a network connection to a new host and
preventing the loading of a new dynamic library and directly calling
a native method. The sandbox security features are designed into the
Java Virtual Machine (JVM). These features are implemented through
array bounds checking, structured memory access, type-safe
reference cast checking to ensure that casting to an object of a
different type is valid, and checking for null references and
automatic garbage collection. These checks are designed to limit
memory accesses to safe, structured operations.
The other answers are distracters.