Which of the following is an effective control in preventing electronic cloning of Radio Frequency Identification (RFID) based access cards?

PIV is a credential standard and framework (FIPS 201) that defines the overall identity verification system, but by itself it is not a specific control that prevents cloning - its effectiveness depends on which authentication mechanism (e.g., CAK or PKI) is actually enforced.

CHUID authentication relies on a static identifier stored on the card that can be read and replicated via RF sniffing, making it inherently vulnerable to replay and cloning attacks rather than preventing them.

Repeated attempt detection is a behavioral/anomaly detection control in the access control system that may flag suspicious activity after cloning has already occurred, but it does not technically prevent the card from being cloned or the cloned credential from being used.

Asymmetric Card Authentication Key (CAK) challenge-response requires the card to cryptographically sign a random challenge using its private key, which cannot be extracted or cloned from the card. Because the private key never leaves the card's secure element, an attacker who captures the RF communication cannot reproduce the correct response for future authentication attempts. This makes cloning the card's cryptographic identity computationally infeasible, directly preventing electronic cloning attacks.