Right choice is (d) Sessions hijacking
The best explanation: Defacing the web server can be done in various ways by fetching credentials through brute-forcing administrator password, through cache poisoning, mail server intrusion, web app bugs and many more.