* Applicable Requirement: IA.L2-3.5.4 - "Use replay-resistant authentication mechanisms for network access to privileged accounts and for network access to non-privileged accounts."
* Why C is Correct: Transport Layer Security (TLS) is explicitly listed in NIST SP 800-171 Rev. 2 as an acceptable replay-resistant mechanism, as it prevents intercepted credentials from being reused.
Why Other Options Are Insufficient:
* A (Encrypted messages): Provides confidentiality but not inherently replay resistance.
* B (Biometrics): Supports authentication but does not prevent replay of transmitted credentials.
* D (MFA devices): Strong authentication, but not necessarily replay-resistant for transmitted session data.
References (CCA Official Sources):
* NIST SP 800-171 Rev. 2 - IA.L2-3.5.4 (Replay Resistance)
* NIST SP 800-171A - IA.L2-3.5.4 Assessment Objectives