Exam CISSP topic 1 question 482 discussion

I go with A Best practices are not always applicable to every situation and may not always be the most appropriate solution. Therefore it's important to understand the unique requirements of the application and its users to ensure that the session timeout is set appropriately.

(Option B) is the BEST reason for determining the session timeout requirement for an application. Industry best practices provide guidance on what has worked well for other applications in similar contexts and can be an important consideration in determining the session timeout requirement. However, it is also important to consider the needs of the specific application and its users to ensure that the session timeout is set appropriately.

I would go with A

A. Application requirements. The amount of idle session time allowed before a timeout should primarily be determined based on the specific requirements of the application and its users. The application's unique functionality, security needs, and user expectations should drive the decision on session timeout requirements.

Its surely dependent on the classification of the data within the application? Id go A

Determining the session timeout requirement for an application based on its specific requirements is the best approach because it ensures that the timeout setting will be appropriate for the application's particular security and usability needs.