Annie has just succeeded in stealing a secure cookie via a XSS attack.

It works because encryption is performed at the application layer (single encryption key)

The scenario is invalid as a secure cookie cannot be replayed

It works because encryption is performed at the network layer (layer 1 encryption)

Any cookie can be replayed irrespective of the session status