FCP FCP Identity and Access Management 2

Question 1

What FIDO concept ensures that a credential registered on example.com cannot be used to authenticate on attacker.com?

Accepted Answer

Cryptographic origin binding via the relying party ID

Answer

Credentials are cryptographically bound to the relying party ID (rpId), which maps to a specific origin, making cross-site credential use cryptographically impossible.

Question 2

In enterprise IAM, what is 'device-bound passkey' compared to a 'synced passkey'?

Accepted Answer

Device-bound passkeys never leave the device's secure enclave; synced passkeys are shared across a user's devices

Answer

Device-bound passkeys are hardware-bound and non-exportable (highest security), while synced passkeys are backed up to cloud keychains and can roam across a user's devices.

Question 3

Which FIDO Alliance document defines conformance requirements that Identity Providers must meet to be listed as a FIDO Certified IdP?

Accepted Answer

FIDO Certified IdP Program Requirements and Test Plan

Answer

The FIDO Certified IdP Program Requirements and Test Plan defines the conformance criteria that Identity Providers must satisfy to earn FIDO certification.

Question 4

What is the function of the 'allowCredentials' list sent by a relying party during a FIDO2 authentication request?

Accepted Answer

To specify which credentials the server will accept for a given user, reducing discovery scope

Answer

The allowCredentials list tells the authenticator which credential IDs are acceptable for the given user, enabling the authenticator to select the correct key without exposing other users' credentials.

Question 5

When integrating FIDO2 with a SCIM-based provisioning system, which event should trigger removal of a user's FIDO credentials from the relying party?

Accepted Answer

SCIM deprovision/delete event for the user account

Answer

A SCIM deprovision or delete event signals that the user's access should be revoked; all associated FIDO credentials must be deleted to prevent orphaned access.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP FCP Identity and Access Management 2