In access management, which concept describes a session that remains active until changed or expires?

In access management, which concept describes a session that remains active until changed or expires?

• A. Token expiry
• B. Certificate validity
• C. Session lifetime
• D. User provisioning

Answer: (C)

Session lifetime is the duration a user session stays active in an access-management system before it must be reauthenticated or terminated. It defines how long you can access resources after login, governed by either an absolute timeout (a fixed end time) or a sliding/idle timeout (the timer resets with activity but ends after inactivity). This matches the idea of a session that remains active until it is changed or expires. Token expiry, by contrast, is about how long a specific credential remains valid and may trigger token refresh, but it doesn’t set the overall session’s lifespan. Certificate validity concerns the trust period of a digital certificate, not the user session. User provisioning covers creating and managing user identities, not session duration.

Session lifetime is the duration a user session stays active in an access-management system before it must be reauthenticated or terminated. It defines how long you can access resources after login, governed by either an absolute timeout (a fixed end time) or a sliding/idle timeout (the timer resets with activity but ends after inactivity). This matches the idea of a session that remains active until it is changed or expires. Token expiry, by contrast, is about how long a specific credential remains valid and may trigger token refresh, but it doesn’t set the overall session’s lifespan. Certificate validity concerns the trust period of a digital certificate, not the user session. User provisioning covers creating and managing user identities, not session duration.