FCP Cheat Sheet 2026

The 30 highest-yield FCP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is the purpose of code review? → To identify bugs, improve code quality, and share knowledge among team members
2. Why is FIDO authentication considered user-friendly? → It eliminates password fatigue
3. Which stored credential field is compared byte-for-byte during the WebAuthn assertion verification process? → stored public key
4. Which authentication method is primarily used in FIDO protocols? → Public-key cryptography
5. What is the primary IAM benefit of replacing passwords with FIDO passkeys for enterprise employees? → Removing the password attack surface (phishing, credential stuffing, reuse)
6. What should be included in an incident response plan? → Detection, containment, eradication, recovery, and lessons learned procedures
7. What is the purpose of the OSI model? → To provide a standard framework for understanding network communications
8. Which of the following is NOT a standard attestation statement format defined in WebAuthn? → OAuth attestation
9. Which transport indicator should a server include when registering a USB security key to indicate the communication channel? → transport: 'usb'
10. In a FIDO2 relying party database, what is the correct data type to use for storing a credential's public key? → BLOB or BYTEA (binary large object)
11. Which FIDO2 client-side JavaScript API method initiates the credential creation ceremony? → navigator.credentials.create()
12. In FIDO2 database design, storing the 'transports' array alongside a credential is useful because: → It allows the RP to suggest the correct authenticator during future authentication
13. What is the CIA triad in information security? → Confidentiality, Integrity, and Availability
14. How does FIDO authentication enhance user privacy? → It does not store biometric data on central servers
15. Which cryptographic method does FIDO use for authentication? → Asymmetric cryptography
16. When integrating FIDO2 with a SCIM-based provisioning system, which event should trigger removal of a user's FIDO credentials from the relying party? → SCIM deprovision/delete event for the user account
17. How does FCP certification benefit employers? → It provides assurance of employee competence and commitment to professional standards
18. A FIDO2 relying party experiences a database breach. Which stored credential field poses the greatest risk if exposed to an attacker? → credential_id
19. When a FIDO2 authenticator is reported lost, what database operation should the relying party perform on that credential record? → Set a revoked flag or status and record the revocation timestamp
20. Which FIDO2 feature enables a user to authenticate without first providing a username, improving the sign-in UX? → Discoverable credentials (resident keys) with conditional UI
21. What is the time complexity of searching in a balanced binary search tree? → O(log n)
22. Which field in the FIDO2 credential record uniquely identifies a credential within a specific relying party? → credential_id
23. What does 'enterprise attestation' in FIDO2 allow an organization to do that standard attestation does not? → Identify individual authenticator devices rather than just models
24. What is the primary goal of a quality improvement program? → To continuously enhance processes and outcomes
25. What should a FCP professional do when they encounter a situation beyond their competence? → Refer to a qualified specialist or seek additional training
26. Which cryptographic algorithm identifier should the FIDO2 credential database store alongside the public key to correctly verify future assertions? → COSE algorithm identifier (e.g., -7 for ES256)
27. What is a phishing attack? → A social engineering attack using fraudulent communications to steal sensitive information
28. Which security measure protects private keys in FIDO authentication? → Secure hardware storage
29. Why is stakeholder management important in projects? → Because stakeholder support and engagement are critical to project success
30. What is an algorithm? → A step-by-step procedure for solving a problem or accomplishing a task