Study. uk . com
  1. Home
  2. All questions
  3. Question 272

CompTIA Security+ study material · question 272 of 611

At AAL2, what does NIST recommend for the overall session timeout and the inactivity timeout?

  1. No more than 30 days overall, with no inactivity timeout required
  2. No more than 24 hours overall and 1 hour inactivity
  3. No more than 12 hours overall and 15 minutes inactivity
  4. No more than 8 hours overall and 30 minutes inactivity
Show the answer

Answer: B. No more than 24 hours overall and 1 hour inactivity

AAL3 tightens these to about 12 hours and 15 minutes; AAL1 allows up to 30 days with no inactivity requirement.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 § 2.2.3

Challenge yourself on this topic → Study as cards