FCP FCP Identity and Access Management 2 — Questions and Answers
Question 1: What FIDO concept ensures that a credential registered on example.com cannot be used to authenticate on attacker.com?
- User presence check
- Cryptographic origin binding via the relying party ID (Correct answer)
- Certificate transparency logging
- Rate limiting on authentication attempts
Correct answer: Cryptographic origin binding via the relying party ID
Credentials are cryptographically bound to the relying party ID (rpId), which maps to a specific origin, making cross-site credential use cryptographically impossible.
Question 2: In enterprise IAM, what is 'device-bound passkey' compared to a 'synced passkey'?
- Device-bound passkeys are backed up to cloud; synced ones are not
- Device-bound passkeys never leave the device's secure enclave; synced passkeys are shared across a user's devices (Correct answer)
- There is no difference between the two
- Device-bound passkeys require a PIN; synced ones use biometrics
Correct answer: Device-bound passkeys never leave the device's secure enclave; synced passkeys are shared across a user's devices
Device-bound passkeys are hardware-bound and non-exportable (highest security), while synced passkeys are backed up to cloud keychains and can roam across a user's devices.
Question 3: Which FIDO Alliance document defines conformance requirements that Identity Providers must meet to be listed as a FIDO Certified IdP?
- FIDO UAF Authenticator Transport Binding Profile
- FIDO Certified IdP Program Requirements and Test Plan (Correct answer)
- WebAuthn Level 3 Editor's Draft
- NIST SP 800-63B
Correct answer: FIDO Certified IdP Program Requirements and Test Plan
The FIDO Certified IdP Program Requirements and Test Plan defines the conformance criteria that Identity Providers must satisfy to earn FIDO certification.
Question 4: What is the function of the 'allowCredentials' list sent by a relying party during a FIDO2 authentication request?
- To list users allowed to log in to the site
- To specify which credentials the server will accept for a given user, reducing discovery scope (Correct answer)
- To enumerate all registered users on the platform
- To set the minimum security level for authenticators
Correct answer: To specify which credentials the server will accept for a given user, reducing discovery scope
The allowCredentials list tells the authenticator which credential IDs are acceptable for the given user, enabling the authenticator to select the correct key without exposing other users' credentials.
Question 5: When integrating FIDO2 with a SCIM-based provisioning system, which event should trigger removal of a user's FIDO credentials from the relying party?
- User password change
- SCIM deprovision/delete event for the user account (Correct answer)
- User's session timeout
- Certificate expiry notification
Correct answer: SCIM deprovision/delete event for the user account
A SCIM deprovision or delete event signals that the user's access should be revoked; all associated FIDO credentials must be deleted to prevent orphaned access.
Question 6: What privacy consideration arises when a relying party uses the same credential ID across multiple services operated by the same organization?
- Credential IDs are publicly visible and could be used to correlate a user's activity across those services (Correct answer)
- Credential IDs are always hashed, so there is no privacy risk
- Using the same ID improves security through key reuse
- It has no impact as credential IDs are server-side only
Correct answer: Credential IDs are publicly visible and could be used to correlate a user's activity across those services
If the same credential ID is visible across services, it can act as a tracker; FIDO2 recommends per-relying-party credential IDs to prevent cross-service correlation.
FCP FCP Identity and Access Management 2
What FIDO concept ensures that a credential registered on example.com cannot be used to authenticate on attacker.com?