The most effective method for positive authentication for physical access is a retina scan because it uses a biometric characteristic that is strongly tied to the individual and difficult to share, transfer, or replicate compared with cards, codes, or visual checks. ISACA materials discussing physical access and identity verification recognize biometrics such as retina scans as a high-assurance authentication mechanism.
Option B is correct because positive authentication means reliably confirming that the person presenting for access is truly the claimed individual. A retina scan verifies "something you are," which is generally stronger than "something you have" or "something you know" for physical access authentication.
Option A is weaker because a proximity card is only possession-based authentication. It can be lost, borrowed, stolen, or shared, so it does not positively verify identity to the same degree as biometrics. This makes it less effective than a retina scan.
Option C is also weaker. A numeric keypad depends on a code that can be disclosed or observed, and a surveillance camera is more detective than authentication-focused. Together they do not provide the same strong identity binding as biometrics.
Option D improves assurance somewhat, but a smart card is still possession-based and a security guard's judgment can be fallible. Human verification helps, but it does not usually match the direct individual-specific certainty of biometric authentication.
Therefore, B is the best answer because a retina scan most effectively provides positive authentication by directly verifying an individual's unique biometric characteristic.
References (Official ISACA):
* ISACA Journal, Against the Quantum Threat: Selective Compatibility - references retina and palm print scans being confirmed at each use to prevent identity theft.
* ISACA News and Trends biometric authentication resources index.

Section: Protection of Information Assets
Explanation:
An integrated test facility is considered a useful audit tool because it compares processing output with independently calculated data.

Explanation/Reference:
Explanation:
Early attempts at producing firewalls operated at the application level of the seven-layer OSI model but this required too much CPU processing power.
Packet filters operate at the network layer and function more efficiently because they only look at the header part of a packet. NO FIREWALL operates at the physical level.

Continuous auditing is a method of performing audit-related activities on a real-time or near real-time basis.
Continuous auditing is best suited for real-time transactions, such as online banking, e-commerce, or electronic funds transfer, that require immediate verification and assurance. Low-value transactions are not necessarily suitable for continuous auditing, as they may not pose significant risks or require frequent monitoring. Irregular transactions are not suitable for continuous auditing, as they may not occur frequently or consistently enough to justify the use of continuous auditing techniques. Manual transactions are not suitable for continuous auditing, as they may not be captured or processed by automated systems that enable continuous auditing. References:
* CISA Review Manual, 27th Edition, pages 307-3081
* CISA Review Questions, Answers & Explanations Database, Question ID: 253