Audit trails maintain a record of system activity by system or application processes and by user activity. In conjunction with appropriate tools and procedures, audit trails can provide individual accountability, a means to reconstruct events, detect intrusions, and identify problems. Audit trail controls are considered technical controls. Monitoring and tracking of incidents is more an operational control related to incident response capability.
Reference(s) used for this question: SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Pages A-50 to A-51).
NOTE: NIST SP 800-26 has been superceded By: FIPS 200, SP 800-53, SP 800-53A You can find the new replacement at: http://csrc.nist.gov/publications/PubsSPs.html However, if you really wish to see the old standard, it is listed as an archived document at: http://csrc.nist.gov/publications/PubsSPArch.html

Explanation/Reference:
Explanation:
The main protocols that make up the IPSec suite and their basic functionality are as follows:
Authentication Header (AH) provides data integrity, data origin authentication, and protection from

replay attacks.
Encapsulating Security Payload (ESP) provides confidentiality, data-origin authentication, and data

integrity.
Internet Security Association and Key Management Protocol (ISAKMP) provides a framework for

security association creation and key exchange.
Internet Key Exchange (IKE) provides authenticated keying material for use with ISAKMP

Incorrect Answers:
B: The IPsec protocol uses Encapsulating Security Payload (ESP) for encryption, not IKE.
C: The IPSec protocol uses data signatures to provide data integrity. IKE is not used for signing the data packets.
D: The IPsec protocol does not enforce quality of service.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 705

Explanation/Reference:
Explanation:
The salvage team must ensure the reliability of primary site. This is done by returning the least-mission- critical processes to the restored original site to stress - test the rebuilt network. As the restored site shows resiliency, more important processes are transferred.
Incorrect Answers:
A: The most critical operations should be to the primary site after, Before, the other less critical operations have been moved.
B: As many operations that the salvage team handles are the same as the operations carried out by the disaster recovery team, there can be very well be an overlap between the team members. A person can be a member of both teams.
D: The order in which the operations are restored should Be exactly the same order in which the operations where moved to the alternative site. You should transfer the least critical operations first.
References:
Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 669