Quick Answer

The answer is anti-replay is matched to sequence number verification. This is correct because both ESP and AH in IPsec use monotonically increasing sequence numbers to detect and reject duplicate or replayed packets, ensuring that an attacker cannot capture and retransmit valid traffic to disrupt the session. On the ENCOR 350-401 exam, this drag-and-drop task tests your ability to distinguish security protocol services: ESP provides confidentiality and optional anti-replay, AH provides integrity and authentication but no encryption, and anti-replay is a shared service verified through sequence numbers. A common trap is confusing anti-replay with encryption or integrity, but remember that anti-replay relies solely on sequence number tracking, not cryptographic operations. For a quick memory tip, think of "Sequence Stops Replay" — the sequence number is the gatekeeper that stops old or stolen packets from being replayed.