Session timeout in web.xml is specified in MINUTES within the element, not seconds. The value 10 represents 10 minutes, whereas 600 would be 600 minutes (10 hours), which is incorrect for this requirement. The element is the correct parent for session timeout configuration.