Section: Access Control
Explanation/Reference:
The Answer: Biometrics; Biometrics are defined as an automated means of identifying or authenticating the identity of a living person based on physiological or behavioral characteristics.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Pages 37,38.

Detective security controls are like a burglar alarm. They detect and report
an unauthorized or undesired event (or an attempted undesired event). Detective security
controls are invoked after the undesirable event has occurred. Example detective security
controls are log monitoring and review, system audit, file integrity checkers, and motion
detection.
Visual surveillance or recording devices such as closed circuit television are used in
conjunction with guards in order to enhance their surveillance ability and to record events
for future analysis or prosecution.
When events are monitored, it is considered preventative whereas recording of events is
considered detective in nature.
Below you have explanations of other types of security controls from a nice guide produce
by James Purcell (see reference below):
Preventive security controls are put into place to prevent intentional or unintentional
disclosure, alteration, or destruction (D.A.D.) of sensitive information. Some example
preventive controls follow:
Policy - Unauthorized network connections are prohibited.
Firewall - Blocks unauthorized network connections.
Locked wiring closet - Prevents unauthorized equipment from being physically plugged into
a network switch.
Notice in the preceding examples that preventive controls crossed administrative, technical,
and physical categories discussed previously. The same is true for any of the controls
discussed in this section.
Corrective security controls are used to respond to and fix a security incident. Corrective
security controls also limit or reduce further damage from an attack. Examples follow:
Procedure to clean a virus from an infected system
A guard checking and locking a door left unlocked by a careless employee
Updating firewall rules to block an attacking IP address
Note that in many cases the corrective security control is triggered by a detective security
control.
Recovery security controls are those controls that put a system back into production after
an incident. Most Disaster Recovery activities fall into this category. For example, after a
disk failure, data is restored from a backup tape.
Directive security controls are the equivalent of administrative controls. Directive controls direct that some action be taken to protect sensitive organizational information. The directive can be in the form of a policy, procedure, or guideline.
Deterrent security controls are controls that discourage security violations. For instance, "Unauthorized Access Prohibited" signage may deter a trespasser from entering an area. The presence of security cameras might deter an employee from stealing equipment. A policy that states access to servers is monitored could deter unauthorized access.
Compensating security controls are controls that provide an alternative to normal controls that cannot be used for some reason. For instance, a certain server cannot have antivirus software installed because it interferes with a critical application. A compensating control would be to increase monitoring of that server or isolate that server on its own network segment.
Note that there is a third popular taxonomy developed by NIST and described in NIST Special Publication 800-53, "Recommended Security Controls for Federal Information Systems." NIST categorizes security controls into 3 classes and then further categorizes the controls within the classes into 17 families. Within each security control family are dozens of specific controls. The NIST taxonomy is not covered on the CISSP exam but is one the CISSP should be aware of if you are employed within the US federal workforce.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 10: Physical security (page 340). and CISSP Study Guide By Eric Conrad, Seth Misenar, Joshua Feldman, page 50-52 and Security Control Types and Operational Security, James E. Purcell, http://www.giac.org/cissp-papers/207.pdf

Explanation/Reference:
The question is explict in asking *easily*. With TCP connection establishment there is a distinct state or sequence that can be expected. Consult the references for further details.
ICMP, IP and UDP don't have any concept of a session; i.e. each packet or datagram is handled individually, with no reference to the contents of the previous one. With no sessions, these protocols usually cannot be filtered on the state of the session.
Some newer firewalls, however, simulate the concept of state for these protocols, and filter out unexpected packets based upon normal usage. Although these are commonly treated like normal stateful filters, they are more complex to program, and hence more prone to errors.
A stateful packet filter or stateful inspection inspects each packet and only allows known connection states through. So, if a SYN/ACK packet was recieved and there was not a prior SYN packet sent it would filter that packet and not let it in. The correct sequence of steps are known and if the sequence or state is incorrect then it is dropped.
The incorrect answers are:
ICMP. ICMP is basically stateless so you could not easily filter them based on the state or sequence.
UDP. UDP has no real state so you could only partially filter them based on the state or sequence. The question was explicit in asking easily. While it is possible, UDP is not the best answer.
IP. IP would refer to the Internet Protocol and as such is stateless so you would not be able to filter it out easily.
The following reference(s) were used for this question:
http://www.nwo.net/ipf/ipf-howto.pdf