Study. uk . com
  1. Home
  2. All questions
  3. Question 484

CISSP study material · question 484 of 500

A single sign-on integration leaves its tokens valid after the user logs out and after long periods of inactivity. How does OWASP classify this?

  1. A broken access control failure, since the token grants continued access.
  2. A logging failure, since the logout event was not recorded.
  3. An authentication failure in its own right, separate from how the user originally proved identity.
  4. A cryptographic failure, since the token's signature outlives the session.
Show the answer

Answer: C. An authentication failure in its own right, separate from how the user originally proved identity.

OWASP's authentication failures entry includes not correctly invalidating user sessions or authentication tokens, mainly single sign-on tokens, during logout or a period of inactivity.

Source: OWASP Top 10 A07:2025 (OWASP) — OWASP Top 10:2025 A07 Authentication Failures > Description

Challenge yourself on this topic → Study as cards