FCP FCP FIDO Implementation and Deployment

Question 1

When deploying a FIDO2 relying party, which origin binding mechanism ensures that credentials cannot be used on phishing sites?

Accepted Answer

The rpId bound to the registered domain origin

Answer

FIDO2 binds credentials to the relying party ID (rpId), which is tied to the origin domain, making phishing impossible because credentials are cryptographically tied to the legitimate site.

Question 2

Which attestation type provides the strongest assurance that an authenticator is genuine and meets specific security requirements during registration?

Accepted Answer

Full (basic) attestation

Answer

Full (basic) attestation uses a manufacturer-issued certificate chain to cryptographically prove the authenticator's make and model, providing the strongest assurance of device authenticity.

Question 3

What is the recommended approach for storing FIDO2 credential public keys on a relying party server?

Accepted Answer

Store them in a database associated with the user account

Answer

FIDO2 public keys must be stored server-side in a database associated with the user account so the relying party can verify authentication assertions.

Question 4

Which FIDO2 client-side JavaScript API method initiates the credential creation ceremony?

Accepted Answer

navigator.credentials.create()

Answer

navigator.credentials.create() is the WebAuthn API call used to initiate the FIDO2 registration ceremony and create a new credential.

Question 5

During FIDO2 registration, what is the purpose of the 'challenge' parameter provided by the relying party?

Accepted Answer

To prevent replay attacks by ensuring each registration is unique

Answer

The challenge is a random nonce that prevents replay attacks by ensuring the authenticator signs a unique value for each registration or authentication ceremony.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP FCP FIDO Implementation and Deployment