Explanation
WS-Trust
The protocol used for issuing security tokens is based on WS-Trust. WS-Trust is a Web service specification that builds on WS-Security. It describes a protocol used for issuance, exchange, and validation of security tokens. WS-Trust provides a solution for interoperability by defining a protocol for issuing and exchanging security tokens, based on token format, namespace, or trust boundaries.
Reference: https://msdn.microsoft.com/en-us/library/ff650503.aspx

Section: Software Development Security

Section: Security Assessment and Testing

Role based access control (RBAC) is a technology that is attracting increasing attention, particularly for commercial applications, because of its potential for reducing the complexity and cost of security administration in large networked applications.

The earlier in the process that security is planned for and implement the cheaper it
is. It is also much more efficient if security is addressed in each phase of the development cycle
rather than an add-on because it gets more complicated to add at the end. If security plan is
developed at the beginning it ensures that security won't be overlooked.
The following answers are incorrect:
The system is optimized prior to the addition of security. Is incorrect because if you wait to
implement security after a system is completed the cost of adding security increases dramtically
and can become much more complex.
The system is procured off-the-shelf. Is incorrect because it is often difficult to add security to off-
the shelf systems.
The system is customized to meet the specific security threat. Is incorrect because this is a
distractor. This implies only a single threat.