An administrator has configured authentication. Which statement is true for users logging on to the application?

The IBM Cognos environment includes a crucial security setting for session management called "Inactivity timeout in seconds". This property is configured within IBM Cognos Configuration and dictates the maximum period a user's session can remain idle. Once this time limit is exceeded, the user's session is automatically terminated, and they are logged off. This is a fundamental behavior applicable to all authenticated users to enhance security and manage system resources, regardless of the specific authentication provider used.

A. When anonymous access is enabled, users can still choose to log on. Anonymous access provides a baseline level of access, but a "Log On" option is typically available for users to authenticate against a configured namespace for greater permissions.

C. This statement is only relevant in a specific scenario where multiple namespaces are configured. Option B describes a universal session management feature that applies to any authenticated user, making it a more generally true statement about the application.

D. Account lockout policies, such as locking an account after a number of failed attempts, are managed by the external authentication provider (e.g., Active Directory, LDAP), not by IBM Cognos itself. Unlocking the account must be done within that provider's administrative tools.

1. IBM Cognos Analytics 11.1.0 Administration and Security Guide, Chapter 4: Initial Configuration, Section: "Configure properties for the Content Manager", Subsection: "Inactivity timeout". This section explicitly details the "Inactivity timeout in seconds" property, stating, "This property specifies the time in seconds that a user can be inactive before the passport expires." This confirms the behavior described in option B.

2. IBM Cognos Analytics 11.0.0 Administration and Security Guide, Chapter 6: "Authentication", Section: "Users, groups, and roles". The guide explains, "Authentication in IBM Cognos software is the process of verifying the identity of a user... This is done by a configured authentication provider." This supports the reasoning that Cognos delegates authentication, including lockout policies (Option D), to the external provider.

3. IBM Cognos Business Intelligence 10.2.2 Administration and Security Guide, Chapter 6: "Configure Authentication Providers". The documentation describes the logon process for multiple namespaces, where a user selects one to authenticate against. This confirms a session is tied to a single namespace, but also highlights that this scenario (Option C) is conditional on having multiple namespaces, unlike the universal inactivity timeout (Option B).

4. IBM Cognos Business Intelligence 10.2.2 Administration and Security Guide, Chapter 5: "Set Up an Initial Configuration", Section: "Enable anonymous access". The guide states, "You can allow users to access IBM Cognos BI without being prompted for a user ID and password by enabling anonymous access." It also shows that authenticated access remains an option, invalidating Option A.