Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IPS phones?

A replay attack captures and retransmits previously recorded legitimate traffic to impersonate a user, not to passively eavesdrop on a live conversation.

A man-in-the-middle attack occurs when an attacker secretly intercepts and potentially relays communications between two parties who believe they are communicating directly with each other. In VoIP environments, this can involve ARP poisoning or VLAN hopping to position the attacker between the two IP phones. The attacker can passively eavesdrop on the RTP media stream without either endpoint detecting the intrusion.

A dictionary attack is a brute-force credential attack that tries common words or phrases to guess passwords, and has no relation to eavesdropping on voice communications.

A known-plaintext attack is a cryptanalysis technique where the attacker has access to both the plaintext and its ciphertext to derive the encryption key, not a method for intercepting voice calls.