The Occupant Emergency Plan (OEP) provides the response procedures for
occupants of a facility in the event of a situation posing a potential threat to the health and safety
of personnel, the environment, or property.
Such events would include a fire, hurricane, criminal attack, or a medical emergency. OEPs are
developed at the facility level, specific to the geographic location and structural design of the
building.
The following are incorrect answers:
The business continuity plan addresses business processes and provides procedures for
sustaining essential business operations while recovering from a significant disruption.
The incident response plan focuses on information security responses to incidents affecting
systems and/or networks. It establishes procedures to address cyber attacks against an
organization's IT systems.
The disaster recovery plan (DRP) applies to major, usually catastrophic events that deny access
to the normal facility for an extended period.
Reference(s) used for this question:
SWANSON, Marianne, & al., National Institute of Standards and Technology (NIST),
http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf

Inappropriate disclosure is a confidentiality, not an integrity goal.
All of the other choices above are integrity goals addressed by the Clark-Wilson integrity model.
The Clark-Wilson model is an integrity model that addresses all three integrity goals:
1. prevent unauthorized users from making modifications,
2. prevent authorized users from making improper modifications, and
3. maintain internal and external consistency through auditing.
NOTE: Biba address only the first goal of integrity above
Reference(s) used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 1384). McGraw-
Hill. Kindle Edition.

Normalization is an important part of database design that ensures that attributes in a table depend only on the primary key. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 47.

An issue with signature-based ID is that only attack signatures that are stored in their database are detected. New attacks without a signature would not be reported. They do require constant updates in order to maintain their effectiveness.
Reference used for this question: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 49