Refer to the information below to answer the question. A large organization uses unique identifiers and requires them at the start of every system session. Application access is based on job classific

Re-authentication on a purely periodic time basis during an active session is not a standard best practice, as it disrupts productive work without a specific security trigger such as inactivity or privilege escalation.

Requiring re-authentication for every business process would create excessive friction and is not a recognized best practice; role-based access control (RBAC) already governs application access based on job classification as described in the scenario.

Sign-off (logout) terminates the session entirely, so re-authentication at that point is irrelevant and does not constitute a security control - the session is already being ended by the user.

Re-authentication after a period of inactivity is a widely recognized security best practice because an unattended session represents a significant risk of unauthorized access if a user walks away from their workstation. This control is referenced in frameworks like NIST SP 800-53 (AC-11, Session Lock) and ISO/IEC 27002, which require systems to lock or terminate sessions after a defined idle period and demand re-authentication before resuming. This mitigates risks such as tailgating or shoulder surfing attacks on abandoned sessions.