FCP FCP Identity and Access Management 1 — Questions and Answers
Question 1: Which FIDO2 feature enables a user to authenticate without first providing a username, improving the sign-in UX?
- Server-side sessions
- Discoverable credentials (resident keys) with conditional UI (Correct answer)
- OAuth implicit flow
- SAML IdP-initiated SSO
Correct answer: Discoverable credentials (resident keys) with conditional UI
Discoverable credentials stored on the authenticator combined with WebAuthn's conditional UI allow users to authenticate without entering a username, creating a truly passwordless experience.
Question 2: How does FIDO2 complement a federated identity system that uses OpenID Connect (OIDC)?
- FIDO2 replaces OIDC tokens entirely
- FIDO2 can serve as the authentication factor at the IdP, strengthening the OIDC login (Correct answer)
- FIDO2 issues JWT access tokens
- FIDO2 provides the authorization server role in OIDC
Correct answer: FIDO2 can serve as the authentication factor at the IdP, strengthening the OIDC login
FIDO2 can be used as the authentication mechanism at an OIDC Identity Provider, ensuring the login step is phishing-resistant before the IdP issues tokens to relying parties.
Question 3: What is the primary IAM benefit of replacing passwords with FIDO passkeys for enterprise employees?
- Eliminating the need for multi-factor authentication entirely
- Removing the password attack surface (phishing, credential stuffing, reuse) (Correct answer)
- Reducing the number of user accounts needed
- Enabling anonymous authentication
Correct answer: Removing the password attack surface (phishing, credential stuffing, reuse)
Passkeys eliminate passwords, removing the primary vector for phishing, credential stuffing, and password reuse attacks that compromise enterprise accounts.
Question 4: In a zero-trust architecture, how does FIDO2 authentication support continuous verification principles?
- By issuing long-lived session cookies that bypass re-authentication
- By providing strong, hardware-bound authentication assertions that can satisfy step-up auth requests (Correct answer)
- By sharing credentials across all enterprise services automatically
- By removing the need for device health checks
Correct answer: By providing strong, hardware-bound authentication assertions that can satisfy step-up auth requests
FIDO2 assertions are cryptographically strong and hardware-bound, making them suitable for satisfying step-up authentication challenges in zero-trust environments that require continuous verification.
Question 5: What is account recovery's greatest challenge in a passwordless FIDO deployment?
- Storing too many public keys
- Providing secure re-enrollment when a user loses all registered authenticators (Correct answer)
- Syncing credentials across browsers
- Handling expired TLS certificates
Correct answer: Providing secure re-enrollment when a user loses all registered authenticators
Account recovery is the hardest problem because the fallback path (if all authenticators are lost) can become the weakest link and potentially undermine FIDO's phishing resistance.
Question 6: Which approach is recommended for users who register multiple authenticators under the same FIDO2 account?
- Sharing a single private key across devices via symmetric encryption
- Independently registering each authenticator, storing separate public keys per credential (Correct answer)
- Using a master seed phrase that generates all device keys
- Synchronizing private keys via encrypted cloud backup only
Correct answer: Independently registering each authenticator, storing separate public keys per credential
Each authenticator should be independently registered, creating a separate credential with its own key pair, so losing one device does not compromise credentials on others.
FCP FCP Identity and Access Management 1
Which FIDO2 feature enables a user to authenticate without first providing a username, improving the sign-in UX?