Answer c is an example of a system-specific policy, in this case
the router's access control lists. The other three answers are
examples of issue-specific policy, as defined by NIST. Issue-specific
policies are similar to program policies, in that they are not
technically focused. While program policy is traditionally more
general and strategic (the organization's computer security
program, for example), issue-specific policy is a nontechnical
policy addressing a single or specific issue of concern to the
organization, such as the procedural guidelines for checking disks
brought to work or e-mail privacy concerns. System-specific policy
is technically focused and addresses only one computer system or
device type. Source: National Institute of Standards and Technology,
An Introduction to Computer Security: The NIST Handbook Special
Publication 800-12.

Explanation/Reference:
Explanation:
Type 2 authentication is based on something you have, like a token. Biometrics for part of Type 3 authentication, which is based on something you are. Something you are refers to an individual's physical traits.
Incorrect Answers:
A, B, C: These options are all TRUE with regards to biometrics.
References:
Conrad, Eric, Seth Misenar, Joshua Feldman, CISSP Study Guide, 2nd Edition, Syngress, Waltham, 2012, pp. 35-37
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 187-189

Section: Software Development Security

There are no such commands within the Structure Query Language (SQL).
SQL commands include Select, Update, Delete, Insert, Grant, Replace, Restore, and
Revoke to name only a few of the common one.
Reference(s) used for this question:
http://technet.microsoft.com/en-us/library/ms186862.aspx
and
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 47.
and
http://www.sqlcommands.net/
and
http://www.cs.utexas.edu/~mitra/csFall2012/cs329/lectures/sql.html

Explanation/Reference:
Explanation:
The Internet Protocol (IP) is implemented at the Network layer.
Incorrect Answers:
A: The session layer implements protocols such as NFS and NetBIOS, but not the IP protocol.
B: The transport layer implements protocols such as TCP and UDP, but not the IP protocol.
D: The Data link layer implements protocols such as ARP and ATM, but not the IP protocol.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 531