What is the maximum idle session time before re-authentication is required?

• A. 15 minutes or less.
• B. 30 minutes.
• C. 5 minutes.
• D. 60 minutes.

Answer: (A)

Idle session timeouts protect cardholder data by ensuring a session is not left open if someone steps away. PCI DSS requires that systems automatically require re-authentication after a short period of inactivity to prevent unauthorized access from an unattended workstation. The maximum allowed idle time is 15 minutes or less, which strikes a balance between usability and security. Longer timeouts, like 30 or 60 minutes, would exceed the recommended limit and raise risk of session hijacking. A 5-minute timeout is stricter than necessary for the maximum, so it doesn’t reflect the allowed upper bound.