Company ABC has started to implement IPv6 in their network and has rolled out dual-stack endpoint devices to their employees. Which security measure prevents ABC from replay attacks?

IPv6 Source Guard validates source IP and MAC address bindings to prevent spoofing, but it does not provide any mechanism to detect or reject replayed packets.

Router Advertisement Guard filters unauthorized RA messages to protect against rogue routers, but it does not address replay attacks against Neighbor Discovery.

IPv6 Destination Guard limits neighbor cache exhaustion attacks by filtering NDP for unknown destinations, but it does not prevent replay attacks.

SeND uses cryptographically generated addresses (CGAs) and RSA signatures to secure IPv6 Neighbor Discovery messages. The Nonce option specifically counters replay attacks by including a unique random value that must match between request and reply - a replayed captured message will carry a stale nonce that fails validation and is discarded. No other listed option provides this per-message uniqueness guarantee.