A network hacker introduces a packet with duplicate sequence numbers to disrupt an IPsec session.

Comprehensive and Detailed Explanation:

B: The IPsec anti-replay mechanism protects against packet injection and replay attacks by rejecting packets outside the anti-replay window. Increasing the anti-replay window (e.g., to 4096) allows legitimate packets with slightly reordered or delayed sequence numbers to be accepted—especially critical during bursts or with asymmetric paths.

Other options:

A: QoS marking does not prevent replay.

C: Tunnel keyword restrictions don ' t address replay attacks.

D: Shaping affects traffic rate, not sequence validation.