Is reauthentication required every three years?

• A. Yes
• B. No
• C. Sometimes
• D. Never

Answer: (B)

Reauthentication frequency is determined by how long a session stays valid and when higher-risk actions are taken, not by a fixed calendar interval. In secure systems, you verify identity again when needed—before performing sensitive operations, after a session timeout or idle period, or when privilege levels change. Because of that, there isn’t a universal rule that you must reauthenticate every three years. The emphasis is on timely verification tied to risk and session management, not a rigid multi-year schedule.