Idle session re-authentication threshold is required after how many minutes of inactivity?

Idle session re-authentication threshold is required after how many minutes of inactivity?

• A. 30 minutes
• B. 60 minutes
• C. 15 minutes
• D. 5 minutes

Answer: (C)

The main concept here is how long a session can sit idle before you’re required to re-enter credentials. In PCI environments, re-authentication after a short period of inactivity helps prevent someone else from taking over a left-open session. Fifteen minutes is a common baseline because it reduces the risk of unattended access without placing an excessive burden on users. Longer gaps like thirty or sixty minutes leave too much time for a session to be exploited if the user walks away, while a very short window like five minutes can disrupt regular workflow. So, fifteen minutes is the best balance, making re-authentication after fifteen minutes of inactivity the correct threshold.

The main concept here is how long a session can sit idle before you’re required to re-enter credentials. In PCI environments, re-authentication after a short period of inactivity helps prevent someone else from taking over a left-open session. Fifteen minutes is a common baseline because it reduces the risk of unattended access without placing an excessive burden on users. Longer gaps like thirty or sixty minutes leave too much time for a session to be exploited if the user walks away, while a very short window like five minutes can disrupt regular workflow. So, fifteen minutes is the best balance, making re-authentication after fifteen minutes of inactivity the correct threshold.