How long does it take for a CVE Shield configuration change to take effect?

Up to 5 minutes. After you change the default policy (Off, Monitor, or Block) for Development, QA, or Production, it can take up to 5 minutes for agents to pick up and apply the new setting. This applies to CVE Shield Free as well — Free doesn't support Block, but Off/Monitor changes are still subject to this delay.
 

See: What Is CVE Monitoring vs. Blocking?