During a review of an enterprise single sign-on deployment that uses Kerberos, an IS auditor wants to determine which control most directly prevents an attacker who has captured a valid authentication ticket from re-submitting it later to gain access. Which control should the auditor verify is functioning correctly?