Lisp, for list processing, is a functional language that processes symbolic expressions rather than numbers. It is used in the artificial intelligence field. The languages cited in the other answers are object-oriented languages.

The correct answer is "Discretionary access control". Answers "Mandatory access control" and "Rule-based access control." require strict adherence to labels and clearances. Answer "Sensitivity-based access control." is a made-up distracter.

The two current conceptual approaches to Intrusion Detection methodology are knowledge-based ID systems and behavior-based ID systems, sometimes referred to as
signature-based ID and statistical anomaly-based ID, respectively.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, 2001, John Wiley & Sons, Page 63.

Single Loss Expectancy (SLE) is the dollar amount that would be lost if there was a
loss of an asset. Annualized Rate of Occurrence (ARO) is an estimated possibility of a threat to an
asset taking place in one year (for example if there is a change of a flood occuring once in 10
years the ARO would be .1, and if there was a chance of a flood occuring once in 100 years then
the ARO would be .01).
The following answers are incorrect:
gross loss expectancy x loss frequency. Is incorrect because this is a distractor.
actual replacement cost - proceeds of salvage. Is incorrect because this is a distractor.
asset value x loss expectancy. Is incorrect because this is a distractor.

Black-box testing observes the system external behavior, while white-box testing is a detailed exam of a logical path, checking the possible conditions.
Source: Information Systems Audit and Control Association, Certified Information Systems
Auditor 2002 review manual, chapter 6: Business Application System Development,
Acquisition, Implementation and Maintenance (page 299).