The correct answer is "Session keys". Session keys are temporary keys assigned by the KDC and used for an allotted period of time as the secret key between two entities. Answer a is incorrect because it refers to asymmetric encryption that is not used in the basic Kerberos protocol. Answer Passwords is incorrect because it is not a key, and answer Tokens is incorrect because a token generates dynamic passwords.

The best design approach to securing a WAN environment that connects sites holding information at various levels of sensitivity, and that requires a high degree of interconnectedness, is to align risk across all interconnected elements to ensure critical threats are detected and handled. A WAN is a type of network that spans a large geographic area, such as a country or a continent, and that connects multiple local area networks (LANs) or metropolitan area networks (MANs), using various technologies, such as routers, switches, or gateways. A WAN can enable the communication and collaboration among the sites or the users that are located in different locations, and that share the same organization or the same purpose. A WAN can also pose a security challenge, as it can expose the sites or the users to various threats, such as eavesdropping, interception, modification, or denial of service, and as it can involve different levels of sensitivity, such as public, private, or confidential, for the information or the data that are transmitted or stored over the WAN. A design approach to securing a WAN environment that connects sites holding information at various levels of sensitivity, and that requires a high degree of interconnectedness, is to align risk across all interconnected elements to ensure critical threats are detected and handled. This design approach involves identifying, assessing, and prioritizing the risks that affect the WAN environment, and applying the appropriate security controls and measures to mitigate or reduce the risks, according to the level of sensitivity and the degree of interconnectedness of the WAN elements, such as the sites, the users, the information, or the data. This design approach can improve the security, performance, and reliability of the WAN environment, and ensure the protection and availability of the information or the data that are transmitted or stored over the WAN
. References: [CISSP CBK, Fifth Edition, Chapter 4, page 351]; [100 CISSP Questions, Answers and Explanations, Question 17].

The most effective response to a hacker who has already gained access to a network and will attempt to pivot to other resources is to segment the network. Network segmentation is a technique that divides the network into smaller and isolated subnetworks, or segments, based on criteria such as function, location, or security level. Network segmentation can limit the impact and spread of a hacker's attack, by restricting the access and communication between the segments, and enforcing the security policies and controls for each segment.
Network segmentation can also help to detect and contain the hacker, by monitoring and analyzing the network traffic and activity between the segments, and isolating the compromised or suspicious segments. The other options are not as effective as segmenting the network, as they either do not address the hacker's attack, do not prevent the hacker from pivoting, or do not mitigate the impact of the attack. References: CISSP - Certified Information Systems Security Professional, Domain 4. Communication and Network Security, 4.1 Implement secure design principles in network architectures, 4.1.1 Apply secure design principles to network architecture, 4.1.1.2 Secure network design elements; CISSP Exam Outline, Domain 4. Communication and Network Security, 4.1 Implement secure design principles in network architectures, 4.1.1 Apply secure design principles to network architecture, 4.1.1.2 Secure network design elements

Positive Pressurization is a condition that exists when more air is supplied to a space than is exhausted, so the air pressure within that space is greater than that in surrounding areas. This condition can cause the situation mentioned above in the answer
B, you can make air go out of a room but not enter to it from the outside.

Explanation/Reference:
Explanation:
One approach to remote access security is the Challenge Handshake Authentication Protocol (CHAP).
CHAP protects the password from eavesdroppers and supports the encryption of communication.
Challenge Handshake Authentication Protocol (CHAP) addresses some of the vulnerabilities found in PAP.
It uses a challenge/response mechanism to authenticate the user instead of sending a password. When a user wants to establish a PPP connection and both ends have agreed that CHAP will be used for authentication purposes, the user's computer sends the authentication server a logon request. The server sends the user a challenge (nonce), which is a random value. This challenge is encrypted with the use of a predefined password as an encryption key, and the encrypted challenge value is returned to the server.
The authentication server also uses the predefined password as an encryption key and decrypts the challenge value, comparing it to the original value sent. If the two results are the same, the authentication server deduces that the user must have entered the correct password, and authentication is granted.
Incorrect Answers:
B: The correct name for the protocol is Challenge Handshake Authentication Protocol (CHAP), not Challenge Handshake Identification Protocol (CHIP).
C: The correct name for the protocol is Challenge Handshake Authentication Protocol (CHAP), not Challenge Handshake Encryption Protocol (CHEP).
D: The correct name for the protocol is Challenge Handshake Authentication Protocol (CHAP), not Challenge Handshake Substitution Protocol (CHSP).
References:
Krutz, Ronald L. and Russell Dean Vines, The CISSP and CAP Prep Guide: Mastering CISSP and CAP, Wiley Publishing, Indianapolis, 2007, p. 66
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 710