Eve is using Replay attack. A replay attack is a type of attack in which attackers capture packets containing passwords or digital signatures whenever packets pass between two hosts on a network. In an attempt to obtain an authenticated connection, the attackers then resend the captured packet to the system. In this type of attack, the attacker does not know the actual password, but can simply replay the captured packet. Session tokens can be used to avoid replay attacks. Bob sends a one-time token to Alice, which Alice uses to transform the password and send the result to Bob (e.g. computing a hash function of the session token appended to the password). On his side Bob performs the same computation; if and only if both values match, the login is successful. Now suppose Mallory has captured this value and tries to use it on another session; Bob sends a different session token, and when Mallory replies with the captured value it will be different from Bob's computation.
Answer option C is incorrect. In the cross site scripting attack, an attacker tricks the user's computer into running code, which is treated as trustworthy because it appears to belong to the server, allowing the attacker to obtain a copy of the cookie or perform other operations.
Answer option B is incorrect. Firewalking is a technique for gathering information about a remote network protected by a firewall. This technique can be used effectively to perform information gathering attacks. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall.
Answer option D is incorrect. In session fixation, an attacker sets a user's session id to one known to him, for example by sending the user an email with a link that contains a particular session id. The attacker now only has to wait until the user logs in.

Confidentiality is a mechanism that ensures that only the intended and authorized recipients are able to read
data. The data is so encrypted that even if an unauthorized user gets access to it, he will not get any meaning
out of it.
Answer option A is incorrect. In information security, integrity means that data cannot be modified without
authorization. This is not the same thing as referential integrity in databases. Integrity is violated when an
employee accidentally or with malicious intent deletes important data files, when a computer virus infects a
computer, when an employee is able to modify his own salary in a payroll database, when an unauthorized
user vandalizes a web site, when someone is able to cast a very large number of votes in an online poll, and so
on. There are many ways in which integrity could be violated without malicious intent. In the simplest case, a
user on a system could mistype someone's address. On a larger scale, if an automated process is not written
and tested correctly, bulk updates to a database could alter data in an incorrect way, leaving the integrity of the
data compromised. Information security professionals are tasked with finding ways to implement controls that
prevent errors of integrity.
Answer option B is incorrect. Data availability is one of the security principles that ensures that the data and
communication services will be available for use when needed (expected). It is a method of describing
products and services availability by which it is ensured that data continues to be available at a required level of
performance in situations ranging from normal to disastrous. Data availability is achieved through redundancy,
which depends upon where the data is stored and how it can be reached.
Answer option D is incorrect. Authentication is the act of establishing or confirming something (or someone) as
authentic, i.e., the claims made by or about the subject are true ("authentification" is a variant of this word).