The attacker likely intercepted a valid token before it expired and reused it within its validity window to gain unauthorized access, which explains the transition from failed attempts with expired tokens to successful access using a valid token.

WHIRLPOOL produces a 512-bit message digest. Because each hexadecimal character represents four bits, a
512-bit digest is displayed as hexadecimal characters. This exactly matches the observed fingerprint length, making option C correct. WHIRLPOOL also exhibits the avalanche effect: a small input change produces a substantially different digest while the output remains fixed in length.
Tiger normally produces a 192-bit digest, represented by 48 hexadecimal characters. BLAKE3 uses a 256-bit default output, although its extendable-output design can generate other lengths; nothing in the scenario indicates that a non-default extended output was configured. MD2 produces a 128-bit digest, represented by only 32 hexadecimal characters.
A message digest provides integrity verification rather than confidentiality. The original package cannot practically be recovered from its digest, but a recipient can hash the received package and compare the result with a trusted value. A mismatch indicates modification or corruption. WHIRLPOOL is standardized in ISO
/IEC 10118-3 and returns a 512-bit digest, as documented in the algorithm's technical description . The 128- character length is therefore the decisive technical indicator.

This scenario represents a Botnet-Based Distributed Denial-of-Service (DDoS) attack, as described in CEH v13 Network Attacks. Compromised internal devices become part of a botnet and are used to launch attacks against external targets.
CEH v13 notes that botnets frequently include IoT devices and employee workstations, making insider- originated DDoS activity a serious concern.

A Denial of Service (DoS) attack is a type of cyberattack that aims to make a machine or network resource unavailable to its intended users by flooding it with traffic or requests that consume its resources. A TCP SYN flood attack is a type of DoS attack that exploits the TCP handshake process by sending a large number of SYN requests to the target server, without completing the connection. A UDP flood attack is a type of DoS attack that sends a large number of UDP packets to random ports on the target server, forcing it to check for the application listening at that port and reply with an ICMP packet. An ICMP flood attack is a type of DoS attack that sends a large number of ICMP packets, such as ping requests, to the target server, overwhelming its ICMP processing capacity.
The attacker's strategy involves a unique mixture of TCP SYN, UDP, and ICMP floods, using 'r' packets per second. The server can handle 'h' packets per second before it starts showing signs of strain. If 'r' surpasses
'h', it overwhelms the server, causing it to become unresponsive. The attacker selects 'r' as a composite number and 'h' as a prime number, making the attack detection more challenging. This is because prime numbers are less predictable and more difficult to factorize than composite numbers, which may hinder the analysis of the attack pattern.
Considering 'r=2010' and different values for 'h', the scenario that would potentially cause the server to falter is the one where 'h=1987' (prime). This is because 'r' is greater than 'h' by 23 packets per second, which means the server cannot handle the incoming traffic and will eventually run out of resources. The other scenarios would not cause the server to falter, as 'h' is either greater than or very close to 'r', which means the server can either manage or barely cope with the incoming traffic. References:
What is a denial-of-service (DoS) attack? | Cloudflare
Denial-of-Service (DoS) Attack: Examples and Common Targets - Investopedia DDoS Attack Types: Glossary of Terms What is a Denial of Service (DoS) Attack? | Webopedia

CEH v13 describes Agent Smith-style attacks as malicious Android operations where an app silently replaces legitimate applications by exploiting weaknesses in the Android app update and installation processes. These attacks often begin when users download seemingly innocent apps from untrusted third- party marketplaces. Once installed, the malicious application injects harmful code into other apps, overwriting them while preserving their icons and interface, allowing the attacker to harvest credentials, display ads, or maintain persistence without detection. CEH explains that this technique takes advantage of Android's APK structure, sideloading vulnerabilities, and lack of signature validation in compromised environments.
Simjacker (Option A) targets SIM toolkit vulnerabilities and does not replace apps. Man-in-the-Disk (Option B) abuses external storage operations but does not overwrite applications. Camfecting (Option D) refers to hijacking smartphone cameras. The described malicious replacement of legitimate apps exactly matches the Agent Smith attack pattern.