There are actually 3 settings that affect session timeouts:
The short version of how it works: the Cluster Manager runs every ClusterManagerActionInterval milliseconds and checks for any sessions flagged for removal. Sessions are flagged for removal after the last user activity was at least SessionTimeout millseconds ago. If EnableKeepAlive is turned on, simply having your browser open in the Mendix app will keep the session alive.
Full documentation of these options is available here.