Which session management control most directly helps reduce risk from long-lived sessions?

• A. Enforce Session Timeouts After Inactivity
• B. Re-authenticate For Sensitive Actions
• C. Invalidate All Sessions On Credential Changes
• D. Monitor Anomalous Sessions

Answer: (D)

Long-lived sessions stay valid for extended periods, so they can be abused without immediate notice. The most direct way to cut that risk is to continuously watch for unusual or unexpected session activity and respond quickly. Monitoring anomalous sessions does exactly that: it flags patterns that don’t fit normal use—such as a session suddenly showing up from a new device or location, multiple concurrent logins, or unusual timing—and can revoke the suspicious session or prompt re-authentication. This proactive detection and remediation target the ongoing risk that a long-lived session poses, rather than just shortening timeouts or protecting against specific actions.

Timeouts after inactivity reduce risk by limiting idle time but don’t address active abuse in long sessions. Re-authenticating for sensitive actions adds a checkpoint for particular operations but doesn’t continuously assess the session’s overall behavior. Invalidating all sessions on credential changes helps after a credential event but isn’t about ongoing monitoring of long-lived sessions.