Which of the following BEST mitigates a replay attack against a system using identity federation and Security Assertion Markup Language (SAML) implementation?

Two-factor authentication strengthens initial user authentication but does not prevent a captured SAML assertion from being replayed after successful authentication has already occurred.

Digital certificates and hardware tokens verify identity at authentication time but do not prevent a valid, already-issued SAML assertion from being intercepted and replayed within its validity window.

SAML assertions include NotBefore and NotOnOrAfter timestamp conditions that enforce a short validity window, meaning a replayed assertion will be rejected once it expires. SSL/TLS encrypts the communication channel, preventing attackers from intercepting assertions in transit to reuse them. Together, these two controls directly address the mechanics of a replay attack against a SAML-based federated identity system.

Strong password complexity policies protect against brute-force and credential-guessing attacks but have no effect on replay attacks, which exploit captured valid tokens rather than guessed credentials.