In a session fixation attack, the attacker sets a known session ID on an application before the victim logs in, and due to the lack of session rotation upon authentication, the attacker can use this predefined session ID to hijack the session once the victim has logged in. Session rotation is a critical security measure that involves changing the session token after a user logs in to prevent session fixation attacks. The incorrect answers, while they are related to session management in various ways, do not directly exploit the lack of session rotation post-authentication.