The Authorizing Official (AO) determines the required level of independence for security control assessors (SCA). The AO is the senior official or executive who has the authority to formally assume responsibility for operating an information system at an acceptable level of risk. The AO decides the extent of independence needed for the SCA to conduct an objective and impartial assessment of the security controls implemented in the system. The level of independence may vary depending on the type, complexity, and criticality of the system, as well as the organizational policies and standards. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3: Security Engineering, page 122.

Explanation/Reference:
A sample of software code or a model (prototype) can be developed to explore a specific approach to a problem before investing expensive time and resources. A team can identify the usability and design problems while working with a prototype and adjust their approach as necessary. Within the software development industry three main prototype models have been invented and used. These are the rapid prototype, evolutionary prototype, and operational prototype.
Incorrect Answers:
B: Change control is not less complicated with prototype systems.
C: Prototyping does nothing to ensure that functions or extras are not added to the intended system.
D: Strong internal controls are not easier to implement with prototyping. Being a new/prototype system, strong internal controls are likely to be more difficult to implement than a non-prototype system.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1114

The true statement for an organization that is using a third-party federated identity service is that the organization establishes a trust relationship with the other organizations. A federated identity service is a service that enables users to access multiple applications or systems across different domains or organizations using a single identity and authentication method. A federated identity service relies on a trust relationship between the identity provider (IdP), which is the organization that issues and manages the user's identity, and the service provider (SP), which is the organization that provides the application or system that the user wants to access. The trust relationship is established by using standards and protocols, such as SAML, OAuth, or OpenID Connect, that enable the exchange of identity and authentication information between the IdP and the SP.