As per the RFC in reference, the Authentication Header (AH) protocol is a mechanism for providing strong integrity and authentication for IP datagrams. It might also provide non-repudiation, depending on which cryptographic algorithm is used and how keying is performed. For example, use of an asymmetric digital signature algorithm, such as RSA, could provide non-repudiation.
from a cryptography point of view, so we will cover it from a VPN point of view here. IPSec is a suite of protocols that was developed to specifically protect IP traffic. IPv4 does not have any integrated security, so IPSec was developed to bolt onto IP and secure the data the protocol transmits. Where PPTP and L2TP work at the data link layer, IPSec works at the network layer of the OSI model. The main protocols that make up the IPSec suite and their basic functionality are as follows: A. Authentication Header (AH) provides data integrity, data origin authentication, and protection from replay attacks. B. Encapsulating
Security Payload (ESP) provides confidentiality, data-origin authentication, and data integrity. C. Internet Security Association and Key Management Protocol (ISAKMP) provides a framework for security association creation and key exchange. D. Internet Key
Exchange (IKE) provides authenticated keying material for use with ISAKMP.
The following are incorrect answers:
ESP is a mechanism for providing integrity and confidentiality to IP datagrams. It may also provide authentication, depending on which lgorithm and algorithm mode are used. Non- repudiation and protection from traffic analysis are not provided by ESP (RFC 1827).
SSL is a secure protocol used for transmitting private information over the Internet. It works by using a public key to encrypt data that is transferred of the SSL connection. OIG 2007, page 976
SSH-2 is a secure, efficient, and portable version of SSH (Secure Shell) which is a secure replacement for telnet.
Reference(s) used for this question:
Shon Harris, CISSP All In One, 6th Edition , Page 705
and
RFC 1826, http://tools.ietf.org/html/rfc1826, paragraph 1.

Change control sub-phase includes Recreating and analyzing the problem,
Determining the interface that is presented to the user, and Establishing the priorities of requests.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 7: Applications and Systems
Development (page 252).

The most common use of the Online Certificate Status Protocol (OCSP) is to obtain the revocation status of an
X.509 digital certificate. A digital certificate is a document that binds the identity and public key of an entity, such as a person, a device, or a website, and is issued and signed by a trusted authority, such as a certificate authority (CA). A digital certificate can be used for various purposes, such as authentication, encryption, or digital signature. A digital certificate can also be revoked by the CA for various reasons, such as expiration, compromise, or misuse. OCSP is a protocol that allows a client, such as a web browser, to query the CA or a designated responder about the current status of a digital certificate, such as valid, revoked, or unknown.
OCSP can provide a faster and more efficient way of checking the revocation status of a digital certificate, compared to other methods, such as certificate revocation lists (CRLs) or delta CRLs. The other options are not the most common use of OCSP, as they either do not relate to the revocation status, or can be obtained from other sources, such as the digital certificate itself or the CA's website. References: CISSP - Certified Information Systems Security Professional, Domain 4. Communication and Network Security, 4.2 Secure network components, 4.2.1 Establish secure communication channels, 4.2.1.1 Cryptography used to maintain communication security; CISSP Exam Outline, Domain 4. Communication and Network Security, 4.2 Secure network components, 4.2.1 Establish secure communication channels, 4.2.1.1 Cryptography used to maintain communication security