FIDO Certified Professional (FCP) — Questions and Answers

Question 1: During integration testing of a FIDO UAF client, the test fails because the ASM (Authenticator Specific Module) returns error code 0x06. What does this typically indicate?

Key storage is full
No suitable authenticator was found (Correct answer)
The command is not supported
User verification was cancelled

Correct answer: No suitable authenticator was found

FIDO UAF ASM error code 0x06 (NO_SUITABLE_AUTHENTICATOR) means no authenticator meeting the policy requirements was discovered.

Question 2: What is the role of the 'rpIdHash' in the authenticatorData structure during FIDO2 authentication?

It contains the hash of the user's password for legacy compatibility
It binds the assertion to the specific relying party, preventing cross-origin replay (Correct answer)
It identifies the user account associated with this credential
It proves the server's identity by including its TLS certificate hash

Correct answer: It binds the assertion to the specific relying party, preventing cross-origin replay

The rpIdHash (SHA-256 of the RP ID) ensures the authenticator only produces assertions for the intended relying party.

Question 3: Which standard is associated with FIDO2 authentication?

WebAuthn (Correct answer)
SAML
OAuth 1.0
RADIUS

Correct answer: WebAuthn

WebAuthn (Web Authentication) is a core component of FIDO2, developed by the FIDO Alliance and W3C. It defines a standard web API that allows web applications to integrate FIDO authentication directly into browsers and operating systems. This enables strong, phishing-resistant, and passwordless authentication experiences for users across the web.

Question 4: After deploying a FIDO2 update, monitoring shows a spike in ERR_INVALID_SIGNATURE errors. What is the most likely root cause?

The FIDO MDS feed was not refreshed
A change in how the server serializes or hashes the clientDataJSON before verification (Correct answer)
The server's TLS certificate expired
Browser cache serving stale JavaScript

Correct answer: A change in how the server serializes or hashes the clientDataJSON before verification

Signature verification requires the exact same clientDataJSON bytes the authenticator signed; serialization changes break this match.

Question 5: Which cryptographic operation does a FIDO2 authenticator perform during the authentication ceremony to prove possession of the private key?

RSA key wrapping of the assertion response
A hash-based message authentication code (HMAC) using a shared secret
Symmetric AES encryption of the challenge
An asymmetric digital signature over the authenticator data and client data hash (Correct answer)

Correct answer: An asymmetric digital signature over the authenticator data and client data hash

During authentication, the authenticator signs the concatenation of authenticatorData and clientDataHash using its credential private key, producing an assertion signature the relying party verifies.

Question 6: Which property of elliptic curve cryptography makes P-256 keys significantly shorter than RSA-2048 keys while providing comparable security?

P-256 keys are padded differently than RSA keys, reducing apparent size
NIST mandated shorter key lengths for P-256 to meet FIDO performance requirements
The ECDLP offers much stronger security per bit than integer factorization, so smaller keys achieve equivalent hardness (Correct answer)
Elliptic curves use binary field arithmetic which compresses key sizes automatically

Correct answer: The ECDLP offers much stronger security per bit than integer factorization, so smaller keys achieve equivalent hardness

The best known ECDLP algorithms are sub-exponential but much harder per bit than integer factorization, making 256-bit ECC roughly equivalent to 3072-bit RSA.

Question 7: What is a WebAuthn attestation statement?

A data structure signed by the authenticator proving its identity and the binding of the new credential (Correct answer)
A JSON Web Token issued by the FIDO Alliance after successful certification
A cryptographic signature from the relying party server confirming successful registration
A user consent record stored in the authenticator's secure enclave after registration

Correct answer: A data structure signed by the authenticator proving its identity and the binding of the new credential

An attestation statement is produced by the authenticator during credential creation and contains a signature over the authenticator data, proving the credential's origin.

Question 8: Which elliptic curve is most commonly used in FIDO2 credentials and identified by COSE key type -7?

Curve25519 (X25519)
P-256 (prime256v1 / secp256r1) (Correct answer)
P-521 (secp521r1)
P-384 (secp384r1)

Correct answer: P-256 (prime256v1 / secp256r1)

COSE algorithm ES256 (-7) uses ECDSA with the P-256 curve, the most widely supported curve in FIDO2 authenticators.

Question 9: A FIDO2 server needs to store backup-eligible credential metadata. Which WebAuthn authenticator flag indicates a credential can be backed up?

AT (Attested Credential Data)
UV (User Verification)
UP (User Presence)
BE (Backup Eligibility) (Correct answer)

Correct answer: BE (Backup Eligibility)

The BE flag in the authenticator data indicates the credential is eligible for cloud backup, which the RP should persist to enforce backup-aware policies.

Question 10: Which FIDO2 extension allows a relying party to request a cryptographic proof that the credential is stored in secure hardware?

hmac-secret extension
credProtect extension (Correct answer)
uvm extension
appid extension

Correct answer: credProtect extension

The credProtect extension sets credential protection policies, while device-bound attestation provides hardware storage proof; the uvm extension reports user verification methods used.

Question 11: Which aspect of asymmetric cryptography allows FIDO to avoid storing any secrets on the relying party server?

Public keys are ephemeral and change with every authentication
Only the private key can create valid signatures, so the server holding only the public key has no secret to steal (Correct answer)
The public key can only decrypt data, never encrypt it
The server derives the private key on demand using the public key

Correct answer: Only the private key can create valid signatures, so the server holding only the public key has no secret to steal

Because signature verification requires only the public key, servers store no secret material — a database breach exposes only public keys, which are useless to attackers.

Question 12: What is the role of the 'aaguid' field in a WebAuthn attestation object?

It serves as the credential ID that uniquely identifies the user's public key
It is a random value generated per-credential to ensure unlinkability
It contains the authenticator's serial number for warranty and support tracking
It identifies the authenticator model/type, enabling relying parties to look up its metadata and certification status (Correct answer)

Correct answer: It identifies the authenticator model/type, enabling relying parties to look up its metadata and certification status

The AAGUID (Authenticator Attestation GUID) is a 16-byte UUID that identifies the authenticator model, allowing the RP to query the FIDO MDS for that model's properties and certification level.

Question 13: Which field in the FIDO2 PublicKeyCredentialCreationOptions specifies which cryptographic algorithms the relying party will accept?

attestation
pubKeyCredParams (Correct answer)
excludeCredentials
authenticatorSelection

Correct answer: pubKeyCredParams

The pubKeyCredParams array lists COSE algorithm identifiers (e.g., ES256, RS256) that the relying party is willing to accept.

Question 14: Which data structure does the FIDO2 authenticator use to store the counter value that prevents replay attacks?

A monotonically increasing integer stored in non-volatile memory (Correct answer)
A Merkle tree of transaction logs
A hash table mapping credential IDs to timestamps
A circular buffer of recent nonces

Correct answer: A monotonically increasing integer stored in non-volatile memory

FIDO2 authenticators maintain a monotonically increasing signature counter in persistent (non-volatile) memory to detect cloned authenticators.

Question 15: How does FIDO's authentication model prevent 'pass-the-hash' style attacks that are common in enterprise environments?

FIDO stores hashes in a hardware security module that prevents extraction
FIDO uses asymmetric challenge-response; there is no reusable hash or token that can be captured and replayed to impersonate a user (Correct answer)
FIDO integrates with Active Directory to prevent lateral movement
FIDO hashes credentials using a different algorithm each time

Correct answer: FIDO uses asymmetric challenge-response; there is no reusable hash or token that can be captured and replayed to impersonate a user

Unlike NTLM or legacy protocols where capturing a credential hash allows authentication, FIDO responses are bound to a unique challenge and cannot be replayed, eliminating the pass-the-hash attack surface.

Question 16: What does the 'UP' flag in authenticatorData indicate?

The user has been uniquely identified by biometrics
The authenticator supports UV (User Verification)
User Presence was verified — the user physically interacted with the authenticator (Correct answer)
The credential uses an unprotected (UP) key storage mode

Correct answer: User Presence was verified — the user physically interacted with the authenticator

The User Presence (UP) flag confirms the authenticator detected a deliberate human gesture, such as touching the device.

Question 17: Which FIDO2 client-side JavaScript API method initiates the credential creation ceremony?

navigator.webauthn.create()
navigator.credentials.get()
navigator.credentials.create() (Correct answer)
window.fido.register()

Correct answer: navigator.credentials.create()

navigator.credentials.create() is the WebAuthn API call used to initiate the FIDO2 registration ceremony and create a new credential.

Question 18: Which attack is FIDO authentication designed to prevent?

SQL injection attacks
Denial-of-service attacks
Phishing attacks (Correct answer)
Man-in-the-middle attacks

Correct answer: Phishing attacks

FIDO authentication is specifically designed to be highly resistant to phishing attacks. Because the authentication process involves cryptographic challenges tied to the specific origin (website) and relies on a private key securely stored on the user's device, even if a user is tricked into visiting a fake website, their FIDO authenticator will refuse to authenticate. This prevents credential compromise, as the private key will only sign challenges from legitimate sites.

Question 19: Which field in the CTAP2 authenticatorMakeCredential response allows a relying party to verify that the authenticator correctly processed the excludeCredentials list?

The attestation statement's x5c chain contains an OID indicating exclusion check compliance
The extensions output map includes an excludeCredentialsProcessed boolean
There is no direct field; the relying party infers compliance from successful completion without a CTAP2 error (0x19 credentialExcluded) (Correct answer)
The credentialId field in the attestedCredentialData

Correct answer: There is no direct field; the relying party infers compliance from successful completion without a CTAP2 error (0x19 credentialExcluded)

If the authenticator holds a credential matching the excludeCredentials list, it returns CTAP2 error code 0x19 (CTAP2_ERR_CREDENTIAL_EXCLUDED) rather than creating a new credential; successful completion implies the list was checked.

Question 20: What is the significance of the signature counter in FIDO U2F and FIDO2 authenticators?

It tracks the number of failed authentication attempts to trigger lockout
It measures the cryptographic strength of each signature produced
It counts how many credentials are stored on the authenticator
It allows relying parties to detect cloned authenticators by identifying non-sequential counter values (Correct answer)

Correct answer: It allows relying parties to detect cloned authenticators by identifying non-sequential counter values

Each authentication increments the counter; a server detecting a lower-than-expected value infers the authenticator may have been cloned.

Question 21: What security property does the 'origin' field in WebAuthn's clientDataJSON provide?

It proves the TLS certificate of the server has not been revoked
It identifies the version of the WebAuthn API used by the browser
It binds the credential operation to the specific web origin, preventing cross-origin replay attacks (Correct answer)
It stores the user's account identifier for the relying party

Correct answer: It binds the credential operation to the specific web origin, preventing cross-origin replay attacks

The origin field (e.g., 'https://example.com:443') is included in clientDataJSON and signed by the authenticator, ensuring the operation cannot be replayed against a different origin.

Question 22: In CTAP2, what is the maximum number of credentials that can be returned in a single 'authenticatorGetNextAssertion' response sequence?

Exactly 5 credentials per CTAP2 specification limit
Only 1 credential per session regardless of stored credentials
Up to the number indicated by the numberOfCredentials field in the first getAssertion response (Correct answer)
Up to 20 credentials as defined by the FIDO Alliance

Correct answer: Up to the number indicated by the numberOfCredentials field in the first getAssertion response

The first authenticatorGetAssertion response includes a numberOfCredentials field; the platform then calls authenticatorGetNextAssertion that many minus one additional times to retrieve all matching credentials.

Question 23: Which FIDO specification defines how authenticators signal support for 'PIN/UV Auth Protocols' and negotiate which protocol version to use with the platform?

FIDO Metadata Service API v3
FIDO UAF Protocol Specification v1.2
CTAP2 specification, authenticatorGetInfo response (pinUvAuthProtocols field) (Correct answer)
WebAuthn Level 2, Section 6.3

Correct answer: CTAP2 specification, authenticatorGetInfo response (pinUvAuthProtocols field)

The CTAP2 authenticatorGetInfo command returns a pinUvAuthProtocols array listing supported PIN/UV auth protocol versions (1 and/or 2), allowing the platform to select a mutually supported version.

Question 24: What is the purpose of code review?

To identify bugs, improve code quality, and share knowledge among team members (Correct answer)
To satisfy management reporting requirements only
To assign blame for errors
To slow down the development process

Correct answer: To identify bugs, improve code quality, and share knowledge among team members

Code review improves quality through peer examination, catches defects early, and spreads knowledge across the team.

Question 25: A FIDO2 relying party must support credential discovery (passkeys). Which database field is essential to return during a discoverable credential assertion flow where no allowCredentials list is sent?

rp_name
aaguid
transports
user_handle (Correct answer)

Correct answer: user_handle

In discoverable flows, the RP receives the user_handle from the authenticator and uses it to look up the user's account without a pre-supplied allowCredentials list.

Question 26: What is account recovery's greatest challenge in a passwordless FIDO deployment?

Storing too many public keys
Handling expired TLS certificates
Providing secure re-enrollment when a user loses all registered authenticators (Correct answer)
Syncing credentials across browsers

Correct answer: Providing secure re-enrollment when a user loses all registered authenticators

Account recovery is the hardest problem because the fallback path (if all authenticators are lost) can become the weakest link and potentially undermine FIDO's phishing resistance.

Question 27: In FIDO CTAP2, which transport is mandatory for all Level 1 certified authenticators?

USB HID
No transport is universally mandatory at Level 1 (Correct answer)
Bluetooth Low Energy
NFC

Correct answer: No transport is universally mandatory at Level 1

FIDO2 Level 1 certification does not mandate a specific transport; authenticators may support USB, NFC, BLE, or internal (platform) transports.

Question 28: Which property of FIDO authenticators prevents a compromised server from revealing users' private keys?

The private key is regenerated on each login
The private key is stored encrypted on the server
The private key never leaves the authenticator device (Correct answer)
The private key is split between the server and the device

Correct answer: The private key never leaves the authenticator device

FIDO private keys are generated and stored securely within the authenticator and are never transmitted to or stored on the relying party's server.

Question 29: Which attestation format uses a certificate chain rooted in a manufacturer CA and is commonly used by TPM-based platform authenticators?

tpm (Correct answer)
fido-u2f
packed
android-key

Correct answer: tpm

The 'tpm' attestation format is specifically defined for Trusted Platform Module authenticators and uses a TPM-issued certificate chain anchored to a manufacturer CA.

Question 30: What is the purpose of 'Token Binding' as referenced in the WebAuthn Level 1 specification?

It defines how FIDO tokens are registered in enterprise directory services
It cryptographically binds the WebAuthn session to the TLS connection, preventing token export attacks (Correct answer)
It binds a hardware security token physically to a specific user workstation
It is a CTAP2 mechanism for binding PIN authentication to a specific relying party

Correct answer: It cryptographically binds the WebAuthn session to the TLS connection, preventing token export attacks

Token Binding (RFC 8471) cryptographically links authentication tokens to a specific TLS connection, so even if a token is intercepted, it cannot be used on a different TLS session; WebAuthn clientDataJSON can include a tokenBinding field.

Question 31: What privacy consideration arises when a relying party uses the same credential ID across multiple services operated by the same organization?

It has no impact as credential IDs are server-side only
Using the same ID improves security through key reuse
Credential IDs are publicly visible and could be used to correlate a user's activity across those services (Correct answer)
Credential IDs are always hashed, so there is no privacy risk

Correct answer: Credential IDs are publicly visible and could be used to correlate a user's activity across those services

If the same credential ID is visible across services, it can act as a tracker; FIDO2 recommends per-relying-party credential IDs to prevent cross-service correlation.

Question 32: Which risk does storing FIDO credential IDs in plaintext server logs introduce?

Credential IDs contain private keys that could be extracted
No risk; credential IDs are public values with no sensitivity
Credential IDs could be used in targeted authentication probing to identify registered users (Correct answer)
Credential IDs expire and logging them wastes storage

Correct answer: Credential IDs could be used in targeted authentication probing to identify registered users

While credential IDs are not secret, logging them in plaintext could allow attackers who access logs to probe for specific users' registered credentials.

Question 33: In CTAP2, what is the purpose of the 'pinUvAuthProtocol' negotiation between the client and authenticator?

It configures the maximum number of allowed PIN retries before lockout
It determines whether the authenticator will enforce resident key storage
It selects the hash algorithm used for attestation signatures
It establishes a shared secret for protecting PIN and UV tokens exchanged between client and authenticator (Correct answer)

Correct answer: It establishes a shared secret for protecting PIN and UV tokens exchanged between client and authenticator

The pinUvAuthProtocol defines the key agreement and encryption scheme used to create a shared secret that protects clientPIN operations and UV tokens exchanged over the CTAP transport.

Question 34: What is the recommended approach for storing FIDO2 credential public keys on a relying party server?

Encrypt them with AES-256 and store in a flat file
Keep them only in browser local storage
Store them in a database associated with the user account (Correct answer)
Hash them with bcrypt before storing

Correct answer: Store them in a database associated with the user account

FIDO2 public keys must be stored server-side in a database associated with the user account so the relying party can verify authentication assertions.

Question 35: What is the purpose of unit testing?

To check network connectivity
To measure code performance only
To test the entire application at once
To verify that individual components of code work correctly in isolation (Correct answer)

Correct answer: To verify that individual components of code work correctly in isolation

Unit tests verify individual components in isolation, catching bugs early and making code more maintainable.

Question 36: A FIDO2 authenticator supports the 'credProtect' extension. What does credProtect level 3 (userVerificationRequired) enforce?

The credential requires a FIDO MDS metadata check before each use
The credential can only be used if the device is connected to AC power
The credential is automatically deleted after three failed UV attempts
The credential is inaccessible without user verification even when the credential ID is provided by the relying party (Correct answer)

Correct answer: The credential is inaccessible without user verification even when the credential ID is provided by the relying party

credProtect level 3 means the authenticator will refuse to use the credential unless UV is performed, regardless of whether the relying party provided the credential ID.

Question 37: Which asymmetric cryptographic algorithm, identified by COSE algorithm value -7, is the most widely supported signature algorithm in FIDO2 authenticators?

ECDSA with P-256 and SHA-256 (ES256) (Correct answer)
RSA PKCS#1 v1.5 with SHA-256 (RS256)
EdDSA with Ed25519 (-8)
ECDSA with P-384 and SHA-384 (ES384)

Correct answer: ECDSA with P-256 and SHA-256 (ES256)

COSE algorithm -7 is ES256 (ECDSA with P-256 and SHA-256), the mandatory-to-implement algorithm for FIDO2 authenticators.

Question 38: What is the purpose of version control in software development?

To backup files to an external drive
To count the number of lines of code written
To track changes, enable collaboration, and maintain code history (Correct answer)
To monitor developer productivity

Correct answer: To track changes, enable collaboration, and maintain code history

Version control systems track all code changes, enabling team collaboration and providing a complete history of modifications.

Question 39: What is the purpose of the 'up' (user presence) flag in the authenticatorData structure?

It records whether the user is currently online
It indicates the user's physical location was verified
It confirms that user verification (PIN or biometric) was completed
It signals that a test of user presence was performed, such as a button press (Correct answer)

Correct answer: It signals that a test of user presence was performed, such as a button press

The 'up' flag in authenticatorData indicates that the authenticator performed a test of user presence, typically a physical touch or button press.

Question 40: What is scope creep?

The planned addition of new features
A type of project risk assessment
Uncontrolled expansion of project scope without corresponding adjustments (Correct answer)
A normal part of every project

Correct answer: Uncontrolled expansion of project scope without corresponding adjustments

Scope creep occurs when additional requirements are added without adjusting timeline, budget, or resources, potentially jeopardizing the project.

Question 41: Which SDLC artifact should document the attestation verification policy, including accepted attestation types and trusted root certificates?

UI wireframes
User story backlog
Security architecture document (Correct answer)
Sprint retrospective notes

Correct answer: Security architecture document

The security architecture document is the appropriate artifact to define attestation policy, trusted roots, and verification procedures.

Question 42: In FIDO UAF, what is a 'Facet ID' and how does it enforce application binding?

An origin (for web) or an app hash (for mobile) that identifies the calling application and is checked against a trusted facet list (Correct answer)
A cryptographic hash of the UAF authenticator's attestation certificate
The username-equivalent identifier sent to the UAF server during registration
A unique identifier assigned by the FIDO Alliance to each certified application

Correct answer: An origin (for web) or an app hash (for mobile) that identifies the calling application and is checked against a trusted facet list

A UAF Facet ID is the web origin or mobile app hash; the server publishes a trusted facet list, and the FIDO client verifies the caller's facet ID is on that list before proceeding, preventing credential use by impersonator apps.

Question 43: Which component is essential in FIDO authentication?

CAPTCHA validation
Shared user credentials
FIDO authenticator (Correct answer)
Centralized password storage

Correct answer: FIDO authenticator

The FIDO authenticator is an essential component in FIDO authentication. This is the device or software that performs the cryptographic operations and verifies the user's identity locally. It can be a built-in biometric sensor (like a fingerprint reader), a hardware security key, or a software authenticator on a mobile device, holding the user's private key securely.

Question 44: A FIDO2 relying party receives an attestation statement of format 'none'. What does this mean for trust decisions?

The credential was created by a software authenticator on Android
The attestation certificate was revoked and stripped by the client
The authenticator is not FIDO certified and must be rejected
No attestation information is conveyed; the RP cannot verify authenticator provenance but may still accept the credential based on policy (Correct answer)

Correct answer: No attestation information is conveyed; the RP cannot verify authenticator provenance but may still accept the credential based on policy

The 'none' attestation format indicates the client chose not to convey attestation; the RP receives no manufacturer verification but may accept the credential if its policy permits unattempted attestation.

Question 45: A FIDO2 relying party experiences a database breach. Which stored credential field poses the greatest risk if exposed to an attacker?

user_handle
Public key
credential_id (Correct answer)
aaguid

Correct answer: credential_id

The credential_id, combined with the RP's allowCredentials list, can be used in targeted phishing; however, the public key alone cannot be used to authenticate without the private key on the authenticator.

Question 46: A relying party's credential database stores the 'aaguid'. What is the primary purpose of persisting this value?

To track the number of failed authentication attempts
To store the user's preferred language
To identify the authenticator model for policy enforcement and display (Correct answer)
To encrypt the credential's private key

Correct answer: To identify the authenticator model for policy enforcement and display

The AAGUID (Authenticator Attestation GUID) identifies the authenticator model, enabling RPs to enforce policies like requiring FIPS-certified devices.

Question 47: During a FIDO2 credential creation, what determines whether a credential is stored as a 'server-side credential' versus a 'discoverable credential' (resident key)?

The requireResidentKey or residentKey hint in the authenticatorSelection criteria (Correct answer)
Whether the authenticator uses CTAP1 or CTAP2 protocol version
The attestation conveyance preference in the creation options
The size of the credential ID returned by the authenticator

Correct answer: The requireResidentKey or residentKey hint in the authenticatorSelection criteria

The authenticatorSelection.requireResidentKey (deprecated) or residentKey field ('required', 'preferred', 'discouraged') tells the authenticator whether to store the private key internally as a discoverable credential.

Question 48: Which organization maintains the FIDO standards?

IETF
FIDO Alliance (Correct answer)
W3C
NIST

Correct answer: FIDO Alliance

The FIDO Alliance is an open industry association dedicated to developing and promoting open, royalty-free standards for simpler, stronger authentication. It was founded to address the lack of interoperability among strong authentication devices and to reduce the world's over-reliance on passwords. The Alliance continues to evolve and maintain the FIDO specifications, ensuring their widespread adoption and effectiveness.

Question 49: When a FIDO2 relying party sets 'userVerification: required' but the authenticator only supports user presence (no PIN or biometric), what is the expected outcome?

The authenticator returns an error and the operation fails, because UV cannot be satisfied (Correct answer)
The browser automatically prompts for a software-based PIN to satisfy the UV requirement
The attestation conveyance is downgraded to 'none' to allow the operation to proceed
The authenticator generates the credential with UV=false and the RP must accept it

Correct answer: The authenticator returns an error and the operation fails, because UV cannot be satisfied

If userVerification is required and the authenticator cannot perform user verification, CTAP2 returns CTAP2_ERR_UNSUPPORTED_OPTION (0x2B) or the platform rejects the assertion with UV=false, causing the ceremony to fail.

Question 50: Which FIDO2 security requirement ensures that an authenticator cannot be silently cloned by malware on the host device?

Server-side credential revocation
Private key non-exportability enforced by the authenticator's secure element or TPM (Correct answer)
Transport encryption via TLS
Client PIN requirement

Correct answer: Private key non-exportability enforced by the authenticator's secure element or TPM

FIDO authenticators store private keys in hardware-protected enclaves (secure element, TPM) that prevent key extraction, making cloning infeasible.

Question 51: In a high-availability FIDO2 deployment with read replicas, what risk arises when authentication reads the sign_count from a replica?

Replicas do not support UNIQUE constraints
Read replicas compress credential_ids by default
Replicas cannot store binary data
Replication lag may cause a stale sign_count to be used, allowing replay attacks (Correct answer)

Correct answer: Replication lag may cause a stale sign_count to be used, allowing replay attacks

Replication lag means replicas may have outdated sign_count values, so authentication reads must always target the primary (master) database node.

Question 52: How does FCP certification benefit employers?

It guarantees perfect job performance
It provides assurance of employee competence and commitment to professional standards (Correct answer)
It eliminates the need for on-the-job training
It reduces salary requirements

Correct answer: It provides assurance of employee competence and commitment to professional standards

Certified employees have demonstrated verified knowledge and dedication to their profession, reducing risk for employers.

Question 53: Which statement best describes the difference between 'attestation' and 'assertion' in FIDO2?

Attestation uses symmetric keys; assertion uses asymmetric keys
Attestation is optional; assertion is always required for FIDO2 compliance
Attestation is produced during registration to prove the authenticator's properties; assertion is produced during authentication to prove possession of the credential (Correct answer)
Attestation is produced during authentication; assertion is produced during registration

Correct answer: Attestation is produced during registration to prove the authenticator's properties; assertion is produced during authentication to prove possession of the credential

Attestation occurs at registration time and proves the authenticator model's trustworthiness, while assertion occurs at authentication time and proves the user possesses the registered private key.

Question 54: What cryptographic algorithm does RS256 refer to in FIDO2 COSE notation?

RSASSA-PSS with SHA-256
RSASSA-PKCS1-v1_5 with SHA-256 (Correct answer)
RSA-OAEP with SHA-256
RSA key agreement using 256-bit keys

Correct answer: RSASSA-PKCS1-v1_5 with SHA-256

COSE algorithm -257 (RS256) specifies RSASSA-PKCS1-v1_5 with SHA-256, commonly supported for platform authenticators like Windows Hello.

Question 55: What is a VPN?

A Visual Processing Node for graphics
A Verified Public Network
A Virtual Private Network that creates an encrypted connection over a public network (Correct answer)
A Very Private Network that uses special hardware

Correct answer: A Virtual Private Network that creates an encrypted connection over a public network

A VPN creates a secure, encrypted tunnel over a public network, protecting data privacy and enabling remote access.

Question 56: In FIDO2, what is the purpose of 'excludeCredentials' in the PublicKeyCredentialCreationOptions?

To exclude specific users from the registration ceremony
To specify which cryptographic algorithms are not permitted for the new credential
To prevent registering a duplicate credential for authenticators already registered by the user (Correct answer)
To block compromised authenticator models from being used

Correct answer: To prevent registering a duplicate credential for authenticators already registered by the user

The excludeCredentials list prevents users from registering the same authenticator twice for the same account, avoiding duplicate credentials on the same device.

Question 57: How should a FIDO2 relying party handle a situation where the received sign_count is less than the stored sign_count?

Accept the authentication and update the counter to the received value
Reject authentication and flag the credential as potentially cloned (Correct answer)
Delete the credential record and prompt re-registration
Accept but do not update the stored sign_count

Correct answer: Reject authentication and flag the credential as potentially cloned

A decreasing sign_count is a strong indicator of a cloned authenticator; the spec requires the RP to reject the assertion and may revoke the credential.

Question 58: Why must the sign_count value in a FIDO2 credential record be updated atomically with its validation check?

To ensure the counter resets on each authentication
To comply with GDPR data minimization rules
To prevent race conditions that could allow replay attacks (Correct answer)
To reduce database write latency

Correct answer: To prevent race conditions that could allow replay attacks

Atomic read-validate-write of the sign_count prevents concurrent requests from exploiting a window where a replayed assertion could pass.

Question 59: A FIDO2 database schema must enforce that the combination of (rpId, credential_id) is unique. What type of constraint achieves this?

CHECK constraint
COMPOSITE UNIQUE constraint (Correct answer)
FOREIGN KEY constraint
DEFAULT constraint

Correct answer: COMPOSITE UNIQUE constraint

A composite unique constraint on (rpId, credential_id) ensures no two credentials share the same ID under the same relying party.

Question 60: What is 'step-up authentication' in the context of FIDO2 and IAM?

Moving from UAF to FIDO2 during a session
Upgrading the authenticator firmware to a newer version
Requiring an additional or stronger FIDO2 assertion when a user attempts a high-risk action (Correct answer)
Increasing the number of registered authenticators

Correct answer: Requiring an additional or stronger FIDO2 assertion when a user attempts a high-risk action

Step-up authentication prompts the user to re-verify with a FIDO2 credential when a sensitive operation is requested, even if they already have an active session.

Question 61: A development team is implementing passkey support. Which standard defines the browser API they must use for credential creation and authentication?

FIDO U2F 1.2
CTAP 2.1 only
FIDO UAF 1.1
W3C Web Authentication (WebAuthn) Level 2 (Correct answer)

Correct answer: W3C Web Authentication (WebAuthn) Level 2

Passkeys are based on the W3C WebAuthn Level 2 standard, which defines the navigator.credentials API used in browsers.

Question 62: Which authentication method is primarily used in FIDO protocols?

Shared secret keys
Biometric templates stored on a server
Symmetric encryption
Public-key cryptography (Correct answer)

Correct answer: Public-key cryptography

FIDO protocols primarily use public-key cryptography for strong, phishing-resistant authentication. This method involves a pair of cryptographically linked keys: a private key stored securely on the user's device and a public key registered with the online service. When authenticating, the device uses the private key to sign a challenge from the service, verifying the user's identity without transmitting sensitive credentials.

Question 63: Which attestation statement format uses a certificate chain rooted in a manufacturer CA and is common for TPM-based authenticators?

TPM attestation (Correct answer)
Packed attestation
Android SafetyNet attestation
FIDO U2F attestation

Correct answer: TPM attestation

TPM attestation format uses a TPM-generated certifyInfo structure signed by the TPM's attestation key (AIK), with a certificate chain back to the TPM manufacturer CA.

Question 64: What is the purpose of the 'timeout' parameter in a FIDO2 PublicKeyCredentialRequestOptions object?

To rate-limit authentication attempts per minute
To specify how long the browser should wait for user interaction before aborting the authentication ceremony (Correct answer)
To define the maximum session length after successful authentication
To set when the credential expires permanently

Correct answer: To specify how long the browser should wait for user interaction before aborting the authentication ceremony

The timeout parameter tells the browser how many milliseconds to wait for the user to interact with their authenticator before the ceremony is aborted, improving UX without leaving open-ended prompts.

Question 65: Which principle does FIDO's 'local verification' model implement by keeping biometric data on the device?

Separation of duties
Mandatory access control
Security through obscurity
Data minimization and privacy by design (Correct answer)

Correct answer: Data minimization and privacy by design

FIDO performs biometric matching locally on the authenticator and never transmits biometric data to the server, embodying privacy-by-design and data minimization principles.

Question 66: Which of the following is a FIDO-supported authentication factor?

Security questions
SMS one-time passwords
Username and password
Hardware security keys (Correct answer)

Correct answer: Hardware security keys

Hardware security keys are a core FIDO-supported authentication factor. These physical devices, often resembling USB drives, securely store cryptographic keys used for authentication. They provide a strong, phishing-resistant method for verifying a user's identity, either as a second factor or as a complete passwordless solution, by requiring physical presence and user interaction.

Question 67: Which attestation type provides a certificate chain rooted in the authenticator manufacturer's attestation CA, with each device holding a unique attestation key?

Basic attestation (Correct answer)
None attestation
Surrogate attestation
Self attestation

Correct answer: Basic attestation

Basic attestation gives each authenticator device a unique attestation key pair signed by the manufacturer's CA, enabling a full PKI trust chain up to a known root.

Question 68: What FIDO concept ensures that a credential registered on example.com cannot be used to authenticate on attacker.com?

Cryptographic origin binding via the relying party ID (Correct answer)
Rate limiting on authentication attempts
User presence check
Certificate transparency logging

Correct answer: Cryptographic origin binding via the relying party ID

Credentials are cryptographically bound to the relying party ID (rpId), which maps to a specific origin, making cross-site credential use cryptographically impossible.

Question 69: A developer tests FIDO2 registration in a localhost environment. Why might the browser reject the PublicKeyCredentialCreationOptions?

WebAuthn requires a minimum of two user verification factors
The challenge was not Base64URL encoded correctly
The rpId does not match the current origin's effective domain (Correct answer)
Localhost is never a valid effective Relying Party ID

Correct answer: The rpId does not match the current origin's effective domain

The rpId must be a registrable domain suffix of the page's origin; if it doesn't match, the browser rejects the options.

Question 70: Which transport indicator should a server include when registering a USB security key to indicate the communication channel?

transport: 'nfc'
transport: 'ble'
transport: 'internal'
transport: 'usb' (Correct answer)

Correct answer: transport: 'usb'

The 'usb' transport indicator specifies that the authenticator communicates via USB, helping the client filter appropriate authenticators during future authentication.

Question 71: What happens to the FIDO credential key pair when a user performs a factory reset of their authenticator?

All stored private keys are permanently destroyed and credentials become unusable (Correct answer)
The private keys are migrated to the new authenticator using a QR code transfer protocol
The key pairs are backed up to the FIDO Alliance cloud and can be restored
The relying party is notified and automatically issues replacement credentials

Correct answer: All stored private keys are permanently destroyed and credentials become unusable

A factory reset destroys the secure element's contents, permanently deleting all private keys; previously registered credentials must be re-registered.

Question 72: What security guarantee does FIDO provide regarding biometric data when a platform authenticator uses fingerprint or face recognition?

The FIDO Alliance stores anonymized biometric hashes for authentication purposes
Biometrics are transmitted only once during initial registration and then deleted from the server
Biometric templates are encrypted and sent to the relying party for secure storage
Biometric data is processed and stored locally on the device and never transmitted to the relying party or any external server (Correct answer)

Correct answer: Biometric data is processed and stored locally on the device and never transmitted to the relying party or any external server

FIDO's design requires that biometric matching occur entirely on-device; the result (pass/fail) is used locally to authorize the cryptographic operation, and raw biometric data never leaves the authenticator.

Question 73: When rolling out a FIDO2 registration feature to existing password-only users, which migration strategy minimizes user disruption?

Delete all existing passwords on launch day
Offer FIDO2 as an additional factor while keeping passwords, then phase out passwords later (Correct answer)
Force all users to re-register immediately
Require FIDO2 only for new user sign-ups

Correct answer: Offer FIDO2 as an additional factor while keeping passwords, then phase out passwords later

Offering FIDO2 alongside passwords allows incremental adoption without locking out users who haven't yet registered an authenticator.

Question 74: When a FIDO2 authenticator signs the concatenation of authenticatorData and clientDataHash, which byte ordering convention is used for the signature counter within authenticatorData?

Variable-length CBOR integer
ASCII decimal string
Little-endian 32-bit unsigned integer
Big-endian 32-bit unsigned integer (Correct answer)

Correct answer: Big-endian 32-bit unsigned integer

The WebAuthn spec mandates the signature counter be encoded as a big-endian 32-bit unsigned integer within the authenticatorData byte array.

Question 75: What is 'RP ID' in the context of FIDO2, and what constraint governs its valid values?

The SHA-256 hash of the relying party's public key certificate
A globally unique UUID assigned by the FIDO Alliance to each relying party
An arbitrary string chosen by the RP with no domain restrictions
A domain string that must be a registrable domain suffix of or equal to the origin's effective domain (Correct answer)

Correct answer: A domain string that must be a registrable domain suffix of or equal to the origin's effective domain

The RP ID must be a valid registrable domain suffix of the origin (e.g., 'example.com' is valid for 'login.example.com'), preventing credential theft across unrelated origins.

Question 76: What does the 'UV' flag in the FIDO2 authenticatorData flags byte signify?

Unique Version identifier for the credential format
UV-token binding is present in the assertion
User Verification was performed (biometric or PIN confirmed) (Correct answer)
User Visibility — the authenticator has a display

Correct answer: User Verification was performed (biometric or PIN confirmed)

The UV (User Verified) flag, when set to 1, indicates the authenticator successfully verified the user through a biometric or PIN during the ceremony.

Question 77: What security property does using separate key pairs for each relying party provide in FIDO?

It prevents user tracking and correlation across different websites (Correct answer)
It enables offline authentication without network access
It allows a single authenticator to support more users simultaneously
It reduces the computational overhead of signature generation

Correct answer: It prevents user tracking and correlation across different websites

Per-relying-party key pairs ensure that colluding websites cannot correlate a user's activity by comparing credential identifiers or public keys.

Question 78: Which protocol is the foundation of FIDO authentication?

Kerberos
OAuth 2.0
FIDO UAF (Correct answer)
SAML

Correct answer: FIDO UAF

FIDO UAF (Universal Authentication Framework) was one of the original FIDO specifications, designed to enable passwordless authentication using various on-device authenticators like biometrics or PINs. It laid the groundwork for secure, multi-factor authentication directly from a user's device, eliminating the need for traditional passwords. This protocol established the core principles of FIDO's approach to strong, user-friendly authentication.

Question 79: What is 'attestation' in the context of FIDO2 registration?

The process of encrypting the credential public key before sending it to the server
The digital signature applied to the user's username during account creation
A cryptographic proof that a specific model of authenticator generated the credential (Correct answer)
The server's confirmation that the user's identity has been verified

Correct answer: A cryptographic proof that a specific model of authenticator generated the credential

Attestation provides a verifiable statement about the authenticator's hardware/firmware characteristics, signed by the device manufacturer.

Question 80: A test engineer wants to verify that a FIDO server correctly implements the 'token binding' extension. What is the primary purpose of this extension in the context of FIDO testing?

To bind the user's biometric template to the credential key
To link the authentication token to the user's account identifier
To cryptographically bind the WebAuthn authentication to the TLS session, preventing token export attacks (Correct answer)
To associate the credential with a specific hardware security module

Correct answer: To cryptographically bind the WebAuthn authentication to the TLS session, preventing token export attacks

Token binding ties the WebAuthn assertion to the TLS connection, ensuring the authentication token cannot be replayed over a different TLS session.

Question 81: During FIDO2 registration, what is the purpose of the 'challenge' parameter provided by the relying party?

To identify the user account
To prevent replay attacks by ensuring each registration is unique (Correct answer)
To specify the allowed authenticator types
To set the credential timeout value

Correct answer: To prevent replay attacks by ensuring each registration is unique

The challenge is a random nonce that prevents replay attacks by ensuring the authenticator signs a unique value for each registration or authentication ceremony.

Question 82: What is 'attestation conveyance' in FIDO2 WebAuthn, and which mode sends no attestation information?

A process to verify user identity; 'indirect' mode sends no attestation
A method for the RP to verify the server certificate; 'direct' mode skips this
A mechanism for the authenticator to prove its model/type; 'none' conveyance sends no attestation (Correct answer)
A process for key exchange; 'enterprise' mode suppresses attestation

Correct answer: A mechanism for the authenticator to prove its model/type; 'none' conveyance sends no attestation

Attestation conveyance is the mechanism by which an authenticator proves its model and properties to the RP; the 'none' conveyance preference results in no attestation statement being sent.

Question 83: In the context of FIDO attestation, what is 'self attestation' (also called surrogate attestation)?

The FIDO Alliance server attests to the authenticator on behalf of the manufacturer
The user self-certifies their identity using a government-issued credential
The relying party generates the attestation certificate for each new credential
The authenticator uses its credential key pair itself as the attestation key, providing no independent proof of device model (Correct answer)

Correct answer: The authenticator uses its credential key pair itself as the attestation key, providing no independent proof of device model

With self attestation, the credential's own private key signs the attestation, so the relying party gains no additional trust about the authenticator model.

Question 84: What differentiates a 'second-factor' (U2F-style) flow from a 'first-factor' passwordless flow in FIDO?

Passwordless always uses platform authenticators; second-factor uses roaming authenticators
Passwordless requires user verification (UV) at the authenticator; second-factor requires only user presence (Correct answer)
Second-factor requires attestation; passwordless does not
Second-factor uses CTAP2; passwordless uses CTAP1

Correct answer: Passwordless requires user verification (UV) at the authenticator; second-factor requires only user presence

In a passwordless first-factor flow the authenticator must perform user verification (PIN, biometric) to replace the password, whereas U2F-style second-factor flows require only user presence.

Question 85: In FIDO U2F (CTAP1), what is contained in the 'key handle' returned during the registration response?

A certificate chain linking the device key to the FIDO root CA
The counter value and user presence byte combined
The user's public key encrypted with the server's public key
Authenticator-specific data that allows the device to regenerate or locate the credential private key for that origin (Correct answer)

Correct answer: Authenticator-specific data that allows the device to regenerate or locate the credential private key for that origin

The U2F key handle is an opaque blob (up to 255 bytes) that the authenticator uses to find or reconstruct the private key for a given application ID, and it is passed back to the authenticator during authentication.

Question 86: In FIDO's CTAP2 protocol, what encoding format is used to serialize data structures for transmission between the authenticator and the platform?

JSON
XML
Protocol Buffers
CBOR (Concise Binary Object Representation) (Correct answer)

Correct answer: CBOR (Concise Binary Object Representation)

CTAP2 uses CBOR for compact binary serialization of authenticator request and response data structures.

Question 87: What is the significance of the 'UP' (User Presence) flag in the FIDO2 authenticatorData flags byte?

It confirms that a human physically interacted with the authenticator (e.g., button press) during the operation (Correct answer)
It indicates the authenticator has verified the user's identity via biometrics or PIN
It signals that the public key credential was created with discoverable credential support
It marks that the authenticator passed FIDO Level 2 certification

Correct answer: It confirms that a human physically interacted with the authenticator (e.g., button press) during the operation

The UP flag confirms the 'test of user presence' — typically a physical touch or button press — proving a human was physically present, which defends against remote software attacks.

Question 88: Which FIDO protocol enables two-factor authentication with security keys?

FIDO UAF
FIDO U2F (Correct answer)
LDAP
OpenID Connect

Correct answer: FIDO U2F

FIDO U2F (Universal Second Factor) is a specific FIDO protocol designed to add a strong second factor to existing password-based logins. It primarily uses external security keys (like USB, NFC, or Bluetooth devices) to provide cryptographic proof of user presence. This significantly enhances security against phishing and other online attacks by requiring a physical token in addition to a password.

Question 89: A relying party sets 'userVerification: required' in PublicKeyCredentialRequestOptions. What happens if the authenticator cannot perform UV?

The authenticator performs user presence instead and sets both 'up' and 'uv' flags
The authentication ceremony fails because the 'uv' flag in authenticatorData will not be set (Correct answer)
The client platform falls back to collecting a password as a substitute
The authenticator generates a new credential with UV capability automatically

Correct answer: The authentication ceremony fails because the 'uv' flag in authenticatorData will not be set

If userVerification is required but the authenticator cannot set the 'uv' flag, the relying party must reject the assertion because the UV requirement is not satisfied.

Question 90: What is a key advantage of FIDO authentication?

It relies solely on knowledge-based authentication
It depends on one-time passwords sent via email
It requires passwords for added security
It eliminates phishing risks (Correct answer)

Correct answer: It eliminates phishing risks

A key advantage of FIDO authentication is that it eliminates phishing risks. Unlike passwords, FIDO credentials are cryptographically bound to specific websites and cannot be tricked into being entered on a fake site. The user's private key never leaves their device, and the authentication process verifies the legitimate origin of the request, making phishing attacks ineffective.

FIDO Certified Professional (FCP)

The FIDO Certified Professional (FCP) certification validates expertise in designing, implementing, and deploying FIDO authentication solutions, covering business requirements analysis, technical implementation, and FIDO protocol standards.

Questions

35 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds