During an assessment, the OSC IT security team provided documentation on how they use replay-resistant...

Applicable Requirement: IA.L2-3.5.4 — “Use replay-resistant authentication mechanisms for network access to privileged accounts and for network access to non-privileged accounts.”

Why C is Correct: Transport Layer Security (TLS) is explicitly listed in NIST SP 800-171 Rev. 2 as an acceptable replay-resistant mechanism, as it prevents intercepted credentials from being reused.

Why Other Options Are Insufficient:

A (Encrypted messages): Provides confidentiality but not inherently replay resistance.

B (Biometrics): Supports authentication but does not prevent replay of transmitted credentials.

D (MFA devices): Strong authentication, but not necessarily replay-resistant for transmitted session data.

References (CCA Official Sources):

NIST SP 800-171 Rev. 2 — IA.L2-3.5.4 (Replay Resistance)

NIST SP 800-171A — IA.L2-3.5.4 Assessment Objectives

===========