An attacker was able to obtain a session token corresponding to an authenticated user in a web application that requires a one time password as a second factor authentication what statement is true in the scenario the attacker still needs the one time password to a person user the attacker will not be able to impersonate the user due to the second factor authentication the attacker can impersonate us with the token as far as the session is active