The facility provides an acceptable level of risk is the primary factor for selection when an organization is evaluating third-party hosting facilities. A third-party hosting facility is a service provider that offers the physical space, infrastructure, and resources to host the servers, systems, and applications of an organization, such as a colocation center, a data center, or a cloud provider. A third-party hosting facility can offer benefits such as cost savings, scalability, and reliability, but it can also pose risks such as data breaches, service disruptions, or compliance violations. The facility provides an acceptable level of risk means that the facility has the appropriate security controls and measures to protect the confidentiality, integrity, and availability of the information and systems of the organization, and to prevent or mitigate the threats, vulnerabilities, or incidents that may affect the information and systems of the organization. The facility provides an acceptable level of risk also means that the facility has the adequate policies and procedures to comply with the legal and regulatory requirements and standards that apply to the information and systems of the organization, and to avoid or minimize the liabilities or penalties that may arise from the non-compliance. The facility provides an acceptable level of risk is the primary factor for selection because it ensures that the organization can achieve its security and compliance objectives and obligations, and that the organization can reduce the residual risk to an acceptable level. The other options are not the primary factors for selection, as they either do not ensure the security and compliance of the information and systems of the organization, or do not address the risk level of the facility. References: CISSP - Certified Information Systems Security Professional, Domain 7. Security Operations, 7.1 Understand and comply with investigations, 7.1.3 Support investigations, 7.1.3.2 Third-party providers; CISSP Exam Outline, Domain 7. Security Operations, 7.1 Understand and comply with investigations, 7.1.3 Support investigations, 7.1.3.2 Third-party providers

Explanation/Reference:
Explanation:
With RAID level 5 data are written in disk sector units to all drives. Parity is written to all drives also, which ensures there is no single point of failure.
Incorrect Answers:
A: RAID Level 1 does not use a parity bit. It uses mirroring of drives.
B: RAID Level 2 does not use block level parity. It uses hamming code parity.
C: RAID level 4 uses byte-level parity.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1270

The Lattice Based Access Control model was developed to deal mainly with information flow in computer systems. Information flow is clearly central to confidentiality but to some extent it also applies to integrity. The basic work in this area was done around 1970 and was driven mostly by the defense sector. Information flow in computer systems is concerned with flow from one security class (also called security label) to another. These controls are applied to objects. An object is a container of information, and an object can be a directory or file.

Allowing objects to be used sequentially by multiple users without a refresh of the objects can lead to disclosure of residual data. It is important that steps be taken to eliminate the chance for the disclosure of residual data.
Object reuse refers to the allocation or reallocation of system resources to a user or, more appropriately, to an application or process. Applications and services on a computer system may create or use objects in memory and in storage to perform programmatic functions. In some cases, it is necessary to share these resources between various system applications. However, some objects may be employed by an application to perform privileged tasks on behalf of an authorized user or upstream application. If object usage is not controlled or the data in those objects is not erased after use, they may become available to unauthorized users or processes.
Disclosure of residual data and Unauthorized obtaining of a privileged execution state are both a problem with shared memory and resources. Not clearing the heap/stack can result in residual data and may also allow the user to step on somebody's session if the security token/identify was maintained in that space. This is generally more malicious and intentional than accidental though. The MOST common issue would be Disclosure of residual data.
The following answers are incorrect:
Unauthorized obtaining of a privileged execution state. Is incorrect because this is not a problem with Object Reuse.
Data leakage through covert channels. Is incorrect because it is not the best answer. A covert channel is a communication path. Data leakage would not be a problem created by
Object Reuse. In computer security, a covert channel is a type of computer security attack that creates a capability to transfer information objects between processes that are not supposed to be allowed to communicate by the computer security policy. The term, originated in 1973 by Lampson is defined as "(channels) not intended for information transfer at all, such as the service program's effect on system load." to distinguish it from
Legitimate channels that are subjected to access controls by COMPUSEC.
Denial of service through a deadly embrace. Is incorrect because it is only a detractor.
References:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third
Edition ((ISC)2 Press) (Kindle Locations 4174-4179). Auerbach Publications. Kindle
Edition.
and
https://www.fas.org/irp/nsa/rainbow/tg018.htm
and
http://en.wikipedia.org/wiki/Covert_channel