ISC2 CISSP Practice Question

The correct answer is implementing session tokens with appropriate timeout values. Session tokens provide a secure way to maintain a user's authenticated state across multiple requests without requiring re-authentication for each interaction. By setting appropriate timeout values (neither too short nor too long), the organization balances security with usability.

The other options have significant issues:

• Long-lasting sessions with extended expiration would create a security vulnerability by maintaining authentication for excessive periods
• Storing credentials in browser cookies would expose authentication information in an insecure manner
• IP-based session tracking is problematic because many users might share the same IP address (especially with NAT) or a legitimate user's IP might change during a session (mobile users)