Detective/physical controls usually require a human to evaluate the input from sensors or cameras to determine if a real threat exists.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 36

Explanation/Reference:
Explanation:
Once a continuity plan is developed, it actually has to be put into action. The people who are assigned specific tasks need to be taught and informed how to fulfill those tasks, and dry runs must be done to walk people through different situations. The drills should take place at least once a year, and the entire program should be continually updated and improved.
Incorrect Answers:
A: Once a month would be too much. The Business Continuity Plan should be tested at least once a year.
B: The Business Continuity Plan should be tested at least once a year. Twice a year is not necessary.
D: The Business Continuity Plan should be tested at least once a year. Once every two years is not recommended.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 951

Information security metrics provide the greatest value to management when based on the value of information assets. The value of information assets is determined by the impact of their loss or compromise on the organization's objectives, reputation, and operations. By measuring the value of information assets, security managers can prioritize the protection of the most critical assets, justify the investment in security controls, and communicate the value of security to the management and stakeholders. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1: Security and Risk Management, page 25. CISSP Practice Exam - FREE 20 Questions and Answers, Question 1.

A third-party vulnerability assessment provides an unbiased evaluation of the organization's security posture, identifying existing vulnerabilities and offering recommendations for mitigation. It is more comprehensive and objective compared to internal reviews or automated scans. References: CISSP Official (ISC)2 Practice Tests, Chapter 5, page 137