FCP FCP FIDO Implementation and Deployment 2

Question 1

Which metadata service should relying parties query to validate authenticator attestations and check for security advisories?

Accepted Answer

FIDO Alliance Metadata Service (MDS)

Answer

The FIDO Alliance Metadata Service (MDS) provides authenticator metadata including attestation certificates and security status, enabling relying parties to validate attestations.

Question 2

What is the significance of the 'user verification' flag (UV) in an authenticator data flags byte?

Accepted Answer

It indicates the authenticator verified the user locally via biometric or PIN

Answer

The UV flag in authenticator data indicates that the authenticator performed local user verification (e.g., biometric or PIN) before completing the ceremony.

Question 3

When implementing passkeys with cross-device authentication, which protocol enables the phone to communicate with the desktop browser?

Accepted Answer

Bluetooth Low Energy (BLE) via CTAP2 hybrid transport

Answer

CTAP2 hybrid transport uses BLE for proximity detection and a QR code to bootstrap a secure channel, enabling cross-device authentication for passkeys.

Question 4

Which CBOR-encoded data structure in FIDO2 carries the credential's public key during registration?

Accepted Answer

AuthenticatorAttestationResponse

Answer

The AuthenticatorAttestationResponse contains the CBOR-encoded attestation object, which includes the credential's public key in the authData structure.

Question 5

What is the maximum number of resident keys (discoverable credentials) typically supported by a hardware security key?

Accepted Answer

Typically 25–50 credentials depending on the device

Answer

Hardware security keys have limited secure storage and typically support 25–50 discoverable (resident) credentials depending on the manufacturer and model.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP FCP FIDO Implementation and Deployment 2