Explanation/Reference:
An investigator's notebook cannot be used as evidence is court. It can only be used by the investigator to refresh his memory during a proceeding, but cannot be submitted as evidence in any form.
The following answers are incorrect:
When the investigator is unwilling to testify. Is incorrect because the notebook cannot be submitted as evidence in any form.
When other forms of physical evidence are not available. Is incorrect because the notebook cannot be submitted as evidence in any form.
If the defense has no objections. Is incorrect because the notebook cannot be submitted as evidence in any form.

Section: Access Control
Explanation/Reference:
D or "minimal protection" is reserved for systems that were evaluated under the TCSEC but did not meet the requirements for a higher trust level.
A is incorrect. A or "Verified Protectection" is the highest trust level under the TCSEC.
E is incorrect. The trust levels are A - D so "E" is not a valid trust level.
F is incorrect. The trust levels are A - D so "F" is not a valid trust level.
CBK, pp. 329 - 330
AIO3, pp. 302 - 306

The Application Layer determines the identity of the communication partners and this is where Non-Repudiation service would be provided as well. See the layers below: C:\Users\MCS\Desktop\1.jpg

DOD Model DoD Model
The following answers are incorrect:
network layer. Is incorrect because the Network Layer mostly has routing protocols, ICMP, IP, and IPSEC. It it not a layer in the DoD Model. It is called the Internet Layer within the DoD model.
transport layer. Is incorrect because the Transport layer provides transparent transfer of data between end users. This is called Host-to-Host on the DoD model but sometimes some books will call it Transport as well on the DoD model.
data link layer. Is incorrect because the Data Link Layer defines the protocols that computers must follow to access the network for transmitting and receiving messages. It is part of the OSI Model. This does not exist on the DoD model, it is called the Link Layer on the DoD model.

Source: TIPTON, Harold F. & KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 2, 2001, CRC Press, NY, Pages 166-167.

The Internet Key Exchange (IKE) protocol is a key management protocol
standard that is used in conjunction with the IPSec standard. IKE enhances IPSec by
providing additional features, flexibility, and ease of configuration for the IPSec standard.
IPSec can however, be configured without IKE by manually configuring the gateways
communicating with each other for example.
A security association (SA) is a relationship between two or more entities that describes
how the entities will use security services to communicate securely.
In phase 1 of this process, IKE creates an authenticated, secure channel between the two
IKE peers, called the IKE security association. The Diffie-Hellman key agreement is always
performed in this phase.
In phase 2 IKE negotiates the IPSec security associations and generates the required key
material for IPSec. The sender offers one or more transform sets that are used to specify
an allowed combination of transforms with their respective settings.
Benefits provided by IKE include:
Eliminates the need to manually specify all the IPSec security parameters in the crypto
maps at both peers.
Allows you to specify a lifetime for the IPSec security association.
Allows encryption keys to change during IPSec sessions.
Allows IPSec to provide anti-replay services.
Permits Certification Authority (CA) support for a manageable, scalable IPSec
implementation.
Allows dynamic authentication of peers.
References:
RFC 2409: The Internet Key Exchange (IKE);
DORASWAMY, Naganand & HARKINS, Dan, Ipsec: The New Security Standard for the
Internet, Intranets, and Virtual Private Networks, 1999, Prentice Hall PTR;
SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.
Reference: http://www.ciscopress.com/articles/article.asp?p=25474