ISC2 CC Access Controls Concepts Practice Question
A security administrator is configuring a session timeout policy. Which of the following are valid reasons for implementing session timeouts? (Choose TWO.)
⚠ Common exam trap
The trap is that candidates pick 'prevent brute-force attacks' because both timeouts and lockouts relate to authentication — but brute force targets password guessing, while session timeouts target session hijacking and unattended workstation exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Limit the window for session hijacking attacks
Option B is correct because a session timeout limits the amount of time an attacker has to reuse a stolen session token or cookie, shrinking the window during which a session hijacking attack can succeed. Option E is correct because automatically terminating idle sessions locks out anyone who approaches an unattended workstation after the legitimate user has walked away, reducing the risk of unauthorized access. Option A is incorrect because password complexity is enforced by password policy settings, not by session timeouts. Option C is incorrect because single sign-on is provided by authentication federation technologies such as SAML, OAuth, or Kerberos, not by session expiration. Option D is incorrect because brute-force protection comes from account lockout thresholds, rate limiting, or CAPTCHA mechanisms, not from session timeouts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enforce password complexity requirements
Why it's wrong here
Password complexity governs credential strength at creation, not session lifetime, so it cannot terminate idle or hijacked sessions. It is tempting because both settings sit under authentication policy, and complexity would be the right control when the requirement is resisting brute-force or dictionary guessing against stored credentials.
- ✓
Limit the window for session hijacking attacks
Why this is correct
Session timeouts terminate idle authenticated sessions after a set period, shrinking the interval during which a stolen session token or cookie remains usable. This directly limits the window for session hijacking attacks, satisfying the stated security objective.
- ✗
Provide single sign-on functionality
Why it's wrong here
Session timeouts terminate idle authenticated sessions; single sign-on is delivered by identity federation and token issuance, which timeouts do not provide. It tempts because both concern session management, and SSO is correct when reducing repeated logins is the requirement.
- ✗
Prevent brute-force attacks on passwords
Why it's wrong here
Timeouts end established sessions; brute-force attacks target credential submission before authentication, so lockout and rate limiting address them. It tempts because both are authentication controls, and lockout policy is correct when throttling repeated failed logins.
- ✓
Reduce the risk of unauthorized access from unattended workstations
Why this is correct
Unattended workstations leave authenticated sessions exposed to anyone physically present, so enforcing a timeout automatically terminates the session after a defined idle period, requiring re-authentication. This directly satisfies the scenario's aim of limiting unauthorised access, since an abandoned session cannot be hijacked once it expires.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.