CISSP: Certified Information Systems Security Professional

By ISC · Question Mode

QuestionQ67

VerifiedIdentity and Access Management (IAM)

An application developer is determining how much idle-session time the application should permit before timing out. Which of the following is the BEST reason for establishing the session-timeout requirement?

Explanation

Idle-session timeout settings should be based on application requirements, including the application’s sensitivity, risk profile, user workflow, and security needs. General industry practices or stakeholder feedback can inform the setting but are not the primary basis for the requirement.

Community Discussion

No comments yet. Be the first to start the discussion!