What WLAN client device behavior is exploited by an attacker during a hijacking attack?

A: When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality. B: When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired. C: After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost. D: As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client-to-client connections, even in an infrastructure BSS. E: Client drivers scan for and connect to access points in the 2.4 GHz band before scanning the 5 GHz band.