ISC2 CC Access Controls Concepts Practice Question
Which of the following best describes the purpose of a session timeout?
⚠ Common exam trap
Test-takers frequently confuse authentication hardening controls (password complexity, lockout) with session lifecycle controls (timeout), since all are 'security settings' but address different attack windows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To automatically log out inactive users
A session timeout is a security control that automatically terminates a user's authenticated session after a defined period of inactivity. Its core purpose is to prevent unauthorized access when a user leaves a workstation unattended, reducing the window of opportunity for someone else to use the still-authenticated session. It does not enforce password rules, restrict data by need-to-know, or block brute-force attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To automatically log out inactive users
Why this is correct
A session timeout is a crucial security mechanism designed to automatically terminate a user's active session after a specified period of inactivity. This process invalidates the session token or cookie, forcing re-authentication and preventing unauthorised access to an unattended workstation or application. Its primary purpose, as the stem asks, is to enhance security by ensuring inactive users are logged out, mitigating risks of session hijacking or data exposure.
- ✗
To enforce password complexity
Why it's wrong here
Session timeout terminates an idle authenticated session, limiting the window for unattended-session abuse; password complexity governs credential strength at creation. It is tempting because both concern authentication, but complexity is enforced by password policy, not by a timer that ends inactive sessions.
- ✗
To restrict access based on need-to-know
Why it's wrong here
Session timeout ends an idle authenticated session; need-to-know restricts which data a user may access based on job relevance. It is tempting because both limit access, but need-to-know is enforced through authorisation rules and data classification, not through expiry of an inactive session.
- ✗
To prevent brute-force attacks
Why it's wrong here
Brute-force attacks are mitigated by account lockout thresholds, rate limiting and strong passwords; session timeout ends idle authenticated sessions. It is tempting because both reduce attack exposure, but timeout acts after authentication on session duration, not on repeated failed logon attempts.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Security control
A security control is a safeguard or countermeasure designed to protect the confidentiality, integrity, and availability of information systems and data.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.