FIDO Certified Professional (FCP) — Questions and Answers

Question 1: A FIDO2 credential database schema includes an 'attestation_object' column. Why might the RP choose to persist this binary blob?

To generate new credentials without requiring the authenticator
To use it as a session token for subsequent logins
To re-verify attestation at a later time or to support audits requiring proof of authenticator authenticity (Correct answer)
To store the user's biometric data securely

Correct answer: To re-verify attestation at a later time or to support audits requiring proof of authenticator authenticity

Persisting the attestation object allows the RP to re-verify the authenticator's certification status if trust anchors are updated after initial registration.

Question 2: What is the principle of least privilege?

Access rights should never be changed once granted
Users should only have the minimum access needed to perform their job (Correct answer)
All users should have administrator access
Privileges should be maximized for efficiency

Correct answer: Users should only have the minimum access needed to perform their job

Least privilege limits access rights to the minimum necessary for job functions, reducing the potential impact of security breaches.

Question 3: Which protocol is the foundation of FIDO authentication?

SAML
FIDO UAF (Correct answer)
OAuth 2.0
Kerberos

Correct answer: FIDO UAF

FIDO UAF (Universal Authentication Framework) was one of the original FIDO specifications, designed to enable passwordless authentication using various on-device authenticators like biometrics or PINs. It laid the groundwork for secure, multi-factor authentication directly from a user's device, eliminating the need for traditional passwords. This protocol established the core principles of FIDO's approach to strong, user-friendly authentication.

Question 4: What is the purpose of version control in software development?

To backup files to an external drive
To track changes, enable collaboration, and maintain code history (Correct answer)
To monitor developer productivity
To count the number of lines of code written

Correct answer: To track changes, enable collaboration, and maintain code history

Version control systems track all code changes, enabling team collaboration and providing a complete history of modifications.

Question 5: Which organization maintains the FIDO standards?

W3C
FIDO Alliance (Correct answer)
NIST
IETF

Correct answer: FIDO Alliance

The FIDO Alliance is an open industry association dedicated to developing and promoting open, royalty-free standards for simpler, stronger authentication. It was founded to address the lack of interoperability among strong authentication devices and to reduce the world's over-reliance on passwords. The Alliance continues to evolve and maintain the FIDO specifications, ensuring their widespread adoption and effectiveness.

Question 6: What is the maximum number of resident keys (discoverable credentials) typically supported by a hardware security key?

Exactly 1 credential per site
Unlimited, stored in cloud backup
Typically 25–50 credentials depending on the device (Correct answer)
10,000 credentials via extended memory

Correct answer: Typically 25–50 credentials depending on the device

Hardware security keys have limited secure storage and typically support 25–50 discoverable (resident) credentials depending on the manufacturer and model.

Question 7: What is the main feature of FIDO2?

It relies solely on SMS authentication
It enables passwordless authentication (Correct answer)
It enhances traditional password security
It is limited to biometric authentication only

Correct answer: It enables passwordless authentication

FIDO2 is the latest generation of FIDO specifications, building upon its predecessors to enable robust passwordless authentication experiences across various platforms and devices. By integrating with web browsers and operating systems via WebAuthn, FIDO2 allows users to log in securely using biometrics, PINs, or external security keys without ever typing a password. This eliminates the vulnerabilities associated with passwords and improves user convenience.

Question 8: How should a FIDO2 relying party handle a situation where the received sign_count is less than the stored sign_count?

Reject authentication and flag the credential as potentially cloned (Correct answer)
Delete the credential record and prompt re-registration
Accept but do not update the stored sign_count
Accept the authentication and update the counter to the received value

Correct answer: Reject authentication and flag the credential as potentially cloned

A decreasing sign_count is a strong indicator of a cloned authenticator; the spec requires the RP to reject the assertion and may revoke the credential.

Question 9: In enterprise IAM, what is 'device-bound passkey' compared to a 'synced passkey'?

Device-bound passkeys never leave the device's secure enclave; synced passkeys are shared across a user's devices (Correct answer)
There is no difference between the two
Device-bound passkeys require a PIN; synced ones use biometrics
Device-bound passkeys are backed up to cloud; synced ones are not

Correct answer: Device-bound passkeys never leave the device's secure enclave; synced passkeys are shared across a user's devices

Device-bound passkeys are hardware-bound and non-exportable (highest security), while synced passkeys are backed up to cloud keychains and can roam across a user's devices.

Question 10: Which metadata service should relying parties query to validate authenticator attestations and check for security advisories?

NIST National Vulnerability Database
Google Safe Browsing API
FIDO Alliance Metadata Service (MDS) (Correct answer)
Microsoft Azure Attestation Service

Correct answer: FIDO Alliance Metadata Service (MDS)

The FIDO Alliance Metadata Service (MDS) provides authenticator metadata including attestation certificates and security status, enabling relying parties to validate attestations.

Question 11: Which sorting algorithm has the best average-case time complexity?

Merge Sort with O(n log n) (Correct answer)
Selection Sort with O(n^2)
Bubble Sort with O(n^2)
Insertion Sort with O(n^2)

Correct answer: Merge Sort with O(n log n)

Merge Sort consistently achieves O(n log n) time complexity using a divide-and-conquer approach.

Question 12: Which cryptographic method does FIDO use for authentication?

Hashing algorithms
Asymmetric cryptography (Correct answer)
Token-based authentication
Symmetric encryption

Correct answer: Asymmetric cryptography

FIDO authentication uses asymmetric cryptography, which is another term for public-key cryptography. This method involves a pair of keys: a private key kept secret on the user's device and a public key shared with the online service. This allows for secure challenge-response authentication where the private key never leaves the device, making it highly resistant to credential theft and impersonation.

Question 13: What FIDO concept ensures that a credential registered on example.com cannot be used to authenticate on attacker.com?

Cryptographic origin binding via the relying party ID (Correct answer)
User presence check
Rate limiting on authentication attempts
Certificate transparency logging

Correct answer: Cryptographic origin binding via the relying party ID

Credentials are cryptographically bound to the relying party ID (rpId), which maps to a specific origin, making cross-site credential use cryptographically impossible.

Question 14: What is the purpose of code review?

To assign blame for errors
To slow down the development process
To satisfy management reporting requirements only
To identify bugs, improve code quality, and share knowledge among team members (Correct answer)

Correct answer: To identify bugs, improve code quality, and share knowledge among team members

Code review improves quality through peer examination, catches defects early, and spreads knowledge across the team.

Question 15: Which FIDO protocol enables two-factor authentication with security keys?

FIDO UAF
LDAP
OpenID Connect
FIDO U2F (Correct answer)

Correct answer: FIDO U2F

FIDO U2F (Universal Second Factor) is a specific FIDO protocol designed to add a strong second factor to existing password-based logins. It primarily uses external security keys (like USB, NFC, or Bluetooth devices) to provide cryptographic proof of user presence. This significantly enhances security against phishing and other online attacks by requiring a physical token in addition to a password.

Question 16: When deploying a FIDO2 relying party, which origin binding mechanism ensures that credentials cannot be used on phishing sites?

Cookie-based session tokens
IP address allowlisting
TLS certificate pinning only
The rpId bound to the registered domain origin (Correct answer)

Correct answer: The rpId bound to the registered domain origin

FIDO2 binds credentials to the relying party ID (rpId), which is tied to the origin domain, making phishing impossible because credentials are cryptographically tied to the legitimate site.

Question 17: What role does the private key play in FIDO authentication?

It is transmitted to the server for validation
It is stored securely on the device (Correct answer)
It is used to encrypt data in transit
It replaces the need for a public key

Correct answer: It is stored securely on the device

In FIDO authentication, the private key is generated and stored securely on the user's authenticator device, such as a smartphone's secure enclave or a hardware security key. It never leaves the device and is used to cryptographically sign authentication challenges. This ensures that the user's identity is proven without the private key ever being exposed to the server or potential attackers.

Question 18: What is the primary purpose of attestation in FIDO2/WebAuthn?

To encrypt the public key during credential registration
To validate the relying party's domain against a whitelist
To prove the authenticity and integrity of an authenticator to a relying party (Correct answer)
To verify the identity of the user during login

Correct answer: To prove the authenticity and integrity of an authenticator to a relying party

Attestation allows a relying party to cryptographically verify that the authenticator is genuine and was manufactured by a trusted vendor.

Question 19: Which technology does FIDO use to enhance authentication security?

Public-key cryptography (Correct answer)
Username and password
Symmetric encryption
SMS-based OTPs

Correct answer: Public-key cryptography

FIDO authentication fundamentally relies on public-key cryptography, also known as asymmetric cryptography. This technology uses a pair of mathematically linked keys – a private key stored securely on the user's device and a public key registered with the online service – to cryptographically prove user identity without transmitting any secrets. This design makes FIDO highly resistant to credential theft and phishing.

Question 20: What is the DRY principle in programming?

Document, Review, Yield
Debug and Run Yearly
Delete Redundant Yields
Dont Repeat Yourself — avoid code duplication (Correct answer)

Correct answer: Dont Repeat Yourself — avoid code duplication

DRY means every piece of knowledge should have a single, unambiguous representation in a system, reducing redundancy.

Question 21: Which standard is associated with FIDO2 authentication?

RADIUS
WebAuthn (Correct answer)
OAuth 1.0
SAML

Correct answer: WebAuthn

WebAuthn (Web Authentication) is a core component of FIDO2, developed by the FIDO Alliance and W3C. It defines a standard web API that allows web applications to integrate FIDO authentication directly into browsers and operating systems. This enables strong, phishing-resistant, and passwordless authentication experiences for users across the web.

Question 22: In FIDO UAF (the predecessor protocol), what term describes a transaction that requires the user to explicitly confirm a specific action using their authenticator?

Silent authentication
Transaction confirmation (Correct answer)
Ambient authentication
Passive assertion

Correct answer: Transaction confirmation

UAF transaction confirmation presents a human-readable transaction description to the user, who must actively confirm it with their authenticator, binding the authentication to the specific action.

Question 23: A FIDO2 relying party wants to support multiple credentials per user. How should the database schema represent this relationship?

Add numbered columns (credential_1, credential_2, ...) to the users table
Create a separate credentials table with a foreign key referencing the users table (Correct answer)
Encode all credentials in a single Base64 string per user
Store all credential_ids in a JSON array in the users table

Correct answer: Create a separate credentials table with a foreign key referencing the users table

A separate credentials table with a user foreign key is the normalized approach that scales cleanly and supports efficient per-user credential queries.

Question 24: Which security measure protects private keys in FIDO authentication?

Secure hardware storage (Correct answer)
Server-side key storage
Manual user entry
Cloud-based key distribution

Correct answer: Secure hardware storage

FIDO private keys are protected by secure hardware storage, such as a Trusted Platform Module (TPM), Secure Enclave, or a dedicated hardware security key. This ensures that the private key is generated, stored, and used in an isolated environment, making it extremely difficult for malware or attackers to extract or compromise it. This hardware-backed security is a cornerstone of FIDO's robust protection.

Question 25: What is a hash collision?

When two different keys produce the same hash value (Correct answer)
When two hash tables are merged
When a hash function returns null
When a hash table runs out of memory

Correct answer: When two different keys produce the same hash value

A hash collision occurs when different inputs map to the same index in a hash table, requiring collision resolution.

Question 26: What does 'enterprise attestation' in FIDO2 allow an organization to do that standard attestation does not?

Reuse the same credential across multiple relying parties
Skip user verification for internal users
Identify individual authenticator devices rather than just models (Correct answer)
Use shorter challenge lengths for performance

Correct answer: Identify individual authenticator devices rather than just models

Enterprise attestation allows organizations to identify individual authenticator devices (not just models), which is useful for asset tracking and compliance in enterprise environments.

Question 27: Which of the following is a FIDO-supported authentication factor?

Username and password
Hardware security keys (Correct answer)
SMS one-time passwords
Security questions

Correct answer: Hardware security keys

Hardware security keys are a core FIDO-supported authentication factor. These physical devices, often resembling USB drives, securely store cryptographic keys used for authentication. They provide a strong, phishing-resistant method for verifying a user's identity, either as a second factor or as a complete passwordless solution, by requiring physical presence and user interaction.

Question 28: What is the primary benefit of public-key cryptography in FIDO authentication?

It eliminates shared secrets (Correct answer)
It relies on symmetric encryption
It requires centralized key management
It uses passwords for authentication

Correct answer: It eliminates shared secrets

Public-key cryptography in FIDO eliminates the need for shared secrets, such as passwords, between the user and the service provider. Instead, the user's device proves identity by signing a challenge with its private key, which the service verifies using the publicly registered key. This design prevents credential theft from server breaches and phishing attacks, as no secret is ever transmitted or stored on the server.

Question 29: What is the purpose of unit testing?

To check network connectivity
To test the entire application at once
To verify that individual components of code work correctly in isolation (Correct answer)
To measure code performance only

Correct answer: To verify that individual components of code work correctly in isolation

Unit tests verify individual components in isolation, catching bugs early and making code more maintainable.

Question 30: Which component is essential in FIDO authentication?

Centralized password storage
Shared user credentials
FIDO authenticator (Correct answer)
CAPTCHA validation

Correct answer: FIDO authenticator

The FIDO authenticator is an essential component in FIDO authentication. This is the device or software that performs the cryptographic operations and verifies the user's identity locally. It can be a built-in biometric sensor (like a fingerprint reader), a hardware security key, or a software authenticator on a mobile device, holding the user's private key securely.

FIDO Certified Professional (FCP)

The FIDO Certified Professional (FCP) certification validates expertise in designing, implementing, and deploying FIDO authentication solutions, covering business requirements analysis, technical implementation, and FIDO protocol standards.

Questions

160 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

pearsonvue.com — Test delivery, eligibility, fees, renewal, retake fee, retake policy, score release, score validity, exam information · verified Nov 2026