The hard-timeout is an absolute session timer configured on a user group. This timer begins as soon as a user successfully authenticates. Once the configured time elapses, FortiGate terminates the user's session and requires them to re-authenticate, regardless of whether the user was active or idle during the session. This behavior directly matches the administrator's requirement for a fixed-duration session that is independent of user activity.

A. auth-on-demand is a user group setting that triggers authentication only when a user initiates a new session, rather than being a session timeout mechanism. B. soft-timeout is not a standard or valid timeout configuration option for user groups within FortiOS. C. idle-timeout disconnects a user only after a specific period of inactivity. The timer resets each time the user generates traffic, which contradicts the requirement. D. new-session is not a timeout setting. It is a parameter that controls how to handle new sessions from an already authenticated user's IP address.

1. FortiOS 7.0.0 Administration Guide, Page 1013, "User Groups" section: "Hard timeout: Enter the number of minutes before the user must re-authenticate. This is an absolute timeout that is not affected by user activity. The range is 0 to 10080 minutes (seven days). The default is 0, which means no hard timeout."

2. FortiOS CLI Reference 7.0.0, Page 2618, config user group command: set hard-timeout - "Set hard timeout in minutes (0 - 10080)." This confirms it as the absolute timeout setting. In contrast, set idle-timeout is described as the inactivity timer.