mediumMultiple ChoiceObjective-mapped
200-901 Practice Question: A company has a web application running on Cisco…
A company has a web application running on Cisco DNA Center. The application uses OAuth 2.0 for authentication with an external identity provider (IdP). Recently, users have reported that they are being logged out unexpectedly after a few minutes of inactivity, even though the IdP token has a 1-hour expiration. The application developer wants to maintain usability while keeping security controls. What is the most likely cause and solution?
⚠ Common exam trap
Cisco often tests the distinction between token expiration and session timeout, where candidates mistakenly focus on token refresh or IdP configuration instead of recognizing that the application's session management is the root cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application session timeout is shorter than the token lifetime; align the application session timeout to the token expiration or implement silent token refresh
The most likely cause is that the application's session timeout is set to a shorter duration than the OAuth 2.0 token's 1-hour expiration. When the application session expires, the user is logged out even though the IdP token is still valid. The solution is to align the application session timeout with the token expiration or implement silent token refresh using a refresh token, which allows the application to obtain a new access token without user interaction, maintaining usability while preserving security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The application session timeout is shorter than the token lifetime; align the application session timeout to the token expiration or implement silent token refresh
Why this is correct
Short application session timeout causes early logout; aligning or using silent refresh solves it.
- ✗
The application is not properly validating the token expiry and needs to refresh tokens proactively
Why it's wrong here
Token refresh would normally prevent logouts, but the issue is likely session timeout, not token expiry.
- ✗
The IdP is configured to log out users automatically after 5 minutes; reconfigure IdP session settings
Why it's wrong here
The IdP session might be separate; but users would see IdP logout page, not just app logout.
- ✗
The OAuth 2.0 access token is set to expire in 5 minutes; increase it to 1 hour
Why it's wrong here
If tokens expired in 5 minutes, users would be logged out, but the problem says IdP token has 1-hour expiration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.