In ensuring it meets its mandates to protect CUI under CMMC, a contractor has implemented a robust, dynamic session lock with pattern-hiding displays…

The scenario describes a session lock activating after a specific period of user inactivity (5 minutes). This aligns directly with CMMC requirements, which are based on NIST SP 800-171. The primary purpose of this control is to automatically prevent unauthorized access to an unattended system after a defined period has elapsed without user interaction. The automatic, time-based initiation is the key mechanism for enforcing this security policy consistently, as described in the question's details.

B: Administrator-initiated locks are for specific administrative or security incidents, not the typical method for handling user inactivity.

C: Authentication is the process of verifying identity to gain access or unlock a session, not to initiate the lock itself.

D: While manual locking is a best practice, CMMC requires an automatic lock, making the "Only" in this option incorrect.

1. NIST Special Publication 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, December 2020. Security Requirement 3.1.11, Page 17, states: "Lock a session after a defined period of inactivity." The discussion notes this prevents unauthorized access to unattended systems.

2. Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0, December 2021. Practice AC.L2-3.1.11, Page 21, requires organizations to "Use session lock with an inactivity timeout." This directly implies an automatic, time-based initiation.

3. NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, September 2020. Control AC-11, "Session Lock," states the system "prevents further access to the system by initiating a session lock after a [Assignment: organization-defined time period] of inactivity." This specifies the trigger is a period of inactivity.