A computer science student needs to fill some information into a secured Adobe PDF job application that was received from a prospective employer. Instead of requesting a new document that allowed…

A man-in-the-middle attack intercepts and potentially alters communications between two parties in transit, which has no relevance to offline password guessing against a local PDF file.

Session hijacking involves stealing or forging an authenticated session token to impersonate a user on a live network connection, not attempting to crack a file's password offline.

A brute-force attack exhaustively tries every possible character combination in sequence until the correct password is found, rather than using a curated list of common passwords as described in the question.

A dictionary attack uses a precompiled list of likely passwords - common words, phrases, or known passwords - to attempt authentication against a target. The question explicitly states the student pulls passwords 'from a list of commonly used passwords,' which precisely matches the definition of a dictionary attack. This differs from brute-force in that it does not try every possible character combination, only the curated list.