FCP FCP Identity and Access Management

Question 1

Which FIDO2 feature enables a user to authenticate without first providing a username, improving the sign-in UX?

Accepted Answer

Discoverable credentials (resident keys) with conditional UI

Answer

Server-side sessions

Answer

OAuth implicit flow

Answer

SAML IdP-initiated SSO

Question 2

How does FIDO2 complement a federated identity system that uses OpenID Connect (OIDC)?

Accepted Answer

FIDO2 can serve as the authentication factor at the IdP, strengthening the OIDC login

Answer

FIDO2 replaces OIDC tokens entirely

Answer

FIDO2 issues JWT access tokens

Answer

FIDO2 provides the authorization server role in OIDC

Question 3

What is the primary IAM benefit of replacing passwords with FIDO passkeys for enterprise employees?

Accepted Answer

Removing the password attack surface (phishing, credential stuffing, reuse)

Answer

Eliminating the need for multi-factor authentication entirely

Answer

Reducing the number of user accounts needed

Answer

Enabling anonymous authentication

Question 4

In a zero-trust architecture, how does FIDO2 authentication support continuous verification principles?

Accepted Answer

By providing strong, hardware-bound authentication assertions that can satisfy step-up auth requests

Answer

By issuing long-lived session cookies that bypass re-authentication

Answer

By sharing credentials across all enterprise services automatically

Answer

By removing the need for device health checks

Question 5

What is account recovery's greatest challenge in a passwordless FIDO deployment?

Accepted Answer

Providing secure re-enrollment when a user loses all registered authenticators

Answer

Storing too many public keys

Answer

Syncing credentials across browsers

Answer

Handling expired TLS certificates

Question 6

Which approach is recommended for users who register multiple authenticators under the same FIDO2 account?

Accepted Answer

Independently registering each authenticator, storing separate public keys per credential

Answer

Sharing a single private key across devices via symmetric encryption

Answer

Using a master seed phrase that generates all device keys

Answer

Synchronizing private keys via encrypted cloud backup only