An administrator wants to configure timeouts for users. Regardless of the user TMs behavior, the timer should start as soon as the user authenticates and expire after the configured value. Which…

auth-on-demand is a feature for re-authentication requests, not a session timeout mechanism.

soft-timeout is typically related to re-authentication prompts after a period, not a strict session termination timer.

idle-timeout terminates a session only after a period of inactivity, which does not meet the requirement of expiring regardless of user behavior.

new-session is not a standard FortiGate user session timeout option; it likely refers to initiating a new connection.

The hard-timeout option on FortiGate enforces a fixed maximum duration for an authenticated user session, starting from the moment of authentication. This timer runs independently of user activity, ensuring the session terminates after the specified period, even if the user is actively generating traffic. It overrides or works in conjunction with other timeouts like idle-timeout.