All the previous protocols operate at the transport layer except for Secure HTTP (S-
HTTP), which operates at the application layer. S-HTTP has been replaced by SSL and TLS.
As it is very well explained in the Shon Harris book:
The transport layer receives data from many different applications and assembles the data into a
stream to be properly transmitted over the network. The main protocols that work at this layer are
TCP, UDP, Secure Sockets Layer (SSL), and Sequenced Packet Exchange (SPX).
NOTE:
Different references can place specific protocols at different layers. For example, many references
place the SSL protocol in the session layer, while other references place it in the transport layer. It
is not that one is right or wrong. The OSI model tries to draw boxes around reality, but some
protocols straddle the different layers. SSL is made up of two protocols- one works in the lower
portion of the session layer and the other works in the transport layer.
For purposes of the CISSP exam, SSL resides in the transport layer.
Reference(s) used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 526). McGraw-Hill.
Kindle Edition.

The correct answer is "Enrollment time".
Answers Set-up time and Log-in time are distracters.
Answer throughput, refers to the rate at which individuals once enrolled can be processed and identified or authenticated by a biometric system.

Explanation/Reference:
Explanation:
In this question, a land attack has been detected by the IDS. A reasonable response from the IDS would be to record selected information about the packets and drop the packets.
Knowledge is accumulated by the IDS vendors about specific attacks and how they are carried out. Models of how the attacks are carried out are developed and called signatures. Each identified attack has a signature, which is used to detect an attack in progress or determine if one has occurred within the network. Any action that is not recognized as an attack is considered acceptable.
An example of a signature is a packet that has the same source and destination IP address. All packets should have a different source and destination IP address, and if they have the same address, this means a Land attack is under way. In a Land attack, a hacker modifies the packet header so that when a receiving system responds to the sender, it is responding to its own address. Now that seems as though it should be benign enough, but vulnerable systems just do not have the programming code to know what to do in this situation, so they freeze or reboot.
Incorrect Answers:
A: A land attack is an old and well known attack so the IDS would know what it is. Knowing the packets are an attack, the IDS should not allow the packet to be processed by the network.
C: When the IP source address and port is the same as the destination IP address and port, this is a land attack. It is not necessary to resolve the IP address and the packets should not be processed.
D: When the IP source address and port is the same as the destination IP address and port, this is a land attack. The source address should not be translated and the packet should not be resent.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 257
http://searchsecurity.techtarget.com/answer/What-is-a-land-attack
http://www.symantec.com/connect/articles/understanding-ids-active-response-mechanisms
http://www.sans.org/security-resources/idfaq/active.php