FCP FCP FIDO Implementation and Deployment

Question 1

When deploying a FIDO2 relying party, which origin binding mechanism ensures that credentials cannot be used on phishing sites?

Accepted Answer

The rpId bound to the registered domain origin

Answer

Cookie-based session tokens

Answer

IP address allowlisting

Answer

TLS certificate pinning only

Question 2

Which attestation type provides the strongest assurance that an authenticator is genuine and meets specific security requirements during registration?

Accepted Answer

Full (basic) attestation

Answer

None attestation

Answer

Self attestation

Answer

Surrogate attestation

Question 3

What is the recommended approach for storing FIDO2 credential public keys on a relying party server?

Accepted Answer

Store them in a database associated with the user account

Answer

Encrypt them with AES-256 and store in a flat file

Answer

Keep them only in browser local storage

Answer

Hash them with bcrypt before storing

Question 4

Which FIDO2 client-side JavaScript API method initiates the credential creation ceremony?

Accepted Answer

navigator.credentials.create()

Answer

navigator.credentials.get()

Answer

window.fido.register()

Answer

navigator.webauthn.create()

Question 5

During FIDO2 registration, what is the purpose of the 'challenge' parameter provided by the relying party?

Accepted Answer

To prevent replay attacks by ensuring each registration is unique

Answer

To identify the user account

Answer

To specify the allowed authenticator types

Answer

To set the credential timeout value

Question 6

What should a relying party do if it receives a FIDO2 attestation with 'none' attestation format?

Accepted Answer

Accept it only if the use case does not require authenticator verification

Answer

Reject the registration as insecure

Answer

Always accept it as the default format

Answer

Request re-registration with a different authenticator