FIDO Certified Professional (FCP) — Questions and Answers

Question 1: During a FIDO2 system's change management process, which action is required before deprecating an older COSE algorithm the server accepted?

Issue a hotfix with no communication
Immediately remove the algorithm from the server's supported list
Notify affected users and provide a re-registration window before removal (Correct answer)
Wait for the algorithm to be automatically removed by the FIDO Alliance

Correct answer: Notify affected users and provide a re-registration window before removal

Users with credentials that use the deprecated algorithm must re-register; they need advance notice and a migration window to avoid lockout.

Question 2: Which FIDO document specifies the security requirements that authenticators must meet to achieve FIDO Authenticator Certification at Level 2 (L2)?

The FIDO Authenticator Security Requirements (FIDO-AUTH-SEC-REQ) specification (Correct answer)
The NIST SP 800-63B Authenticator Assurance Level 2 guidelines only
The WebAuthn W3C Recommendation, Appendix B
The CTAP2 specification's normative conformance section

Correct answer: The FIDO Authenticator Security Requirements (FIDO-AUTH-SEC-REQ) specification

The FIDO Authenticator Security Requirements document defines the hardware and software security properties (e.g., secure element, restricted operating environment) needed for each FIDO certification level from L1 to L3+.

Question 3: Why does FIDO2 specify that the clientDataHash (hash of clientDataJSON) — not the raw clientDataJSON — is sent to the authenticator for signing?

Because authenticators lack the processing power to handle variable-length JSON
To reduce the payload size transmitted over the CTAP2 transport layer (Correct answer)
To allow the authenticator to validate the JSON structure independently
To prevent the authenticator from learning the origin URL and session details, preserving privacy

Correct answer: To reduce the payload size transmitted over the CTAP2 transport layer

Transmitting only the hash over CTAP keeps bandwidth low and is sufficient since the server verifies the full clientDataJSON separately.

Question 4: In a DevSecOps pipeline for a FIDO relying party, which gate should block a merge if violated?

A unit test for a helper function was deleted
The server's challenge validation was removed to simplify the code (Correct answer)
A new optional logging field was added
A developer added a new UI font

Correct answer: The server's challenge validation was removed to simplify the code

Removing challenge validation eliminates replay-attack protection; a security-focused gate must block such regressions automatically.

Question 5: What is an algorithm?

A hardware component of a computer
A type of programming language
A network protocol
A step-by-step procedure for solving a problem or accomplishing a task (Correct answer)

Correct answer: A step-by-step procedure for solving a problem or accomplishing a task

An algorithm is a finite sequence of well-defined instructions for solving a specific problem or performing a computation.

Question 6: Under which condition will a FIDO2 authenticator increment its global signature counter during an authentication ceremony?

The counter is incremented only during registration, not authentication
After successfully generating an assertion signature, before returning the response to the platform (Correct answer)
Only when the user verification flag (UV) is set to true in the response
Only when the relying party explicitly requests counter increment in the get assertion options

Correct answer: After successfully generating an assertion signature, before returning the response to the platform

Authenticators increment the signature counter for each authentication assertion generated, providing relying parties with a mechanism to detect cloned authenticators (unexpected counter decreases or duplicates).

Question 7: When a FIDO2 relying party sets 'userVerification: required' but the authenticator only supports user presence (no PIN or biometric), what is the expected outcome?

The attestation conveyance is downgraded to 'none' to allow the operation to proceed
The authenticator generates the credential with UV=false and the RP must accept it
The authenticator returns an error and the operation fails, because UV cannot be satisfied (Correct answer)
The browser automatically prompts for a software-based PIN to satisfy the UV requirement

Correct answer: The authenticator returns an error and the operation fails, because UV cannot be satisfied

If userVerification is required and the authenticator cannot perform user verification, CTAP2 returns CTAP2_ERR_UNSUPPORTED_OPTION (0x2B) or the platform rejects the assertion with UV=false, causing the ceremony to fail.

Question 8: During FIDO2 authentication, the relying party must verify that the 'origin' in clientDataJSON matches its own origin. What attack does this check prevent?

SQL injection attacks against the credential database
Timing side-channel attacks against the signature verification routine
Phishing attacks where a malicious site tricks the authenticator into producing assertions for the victim's site (Correct answer)
Man-in-the-middle attacks that decrypt the TLS session

Correct answer: Phishing attacks where a malicious site tricks the authenticator into producing assertions for the victim's site

Origin binding ensures an assertion produced while visiting a phishing site is useless against the legitimate RP because the origin field won't match.

Question 9: What cryptographic guarantee does FIDO2 provide against a compromised TLS connection (man-in-the-middle) attempting to relay authentication requests to the victim's authenticator?

FIDO2 uses mutual TLS between the authenticator and relying party to prevent relay attacks
FIDO2 relies entirely on TLS certificate pinning to prevent MITM attacks
Challenge freshness enforced by the TLS layer prevents all replay scenarios
The origin and rpIdHash are signed by the authenticator, so a MITM cannot forward assertions to a different origin (Correct answer)

Correct answer: The origin and rpIdHash are signed by the authenticator, so a MITM cannot forward assertions to a different origin

Because the authenticator signs the origin (via clientDataJSON hash) and rpIdHash, any assertion is cryptographically bound to the exact origin and RP ID; a MITM operating on a different domain cannot use the signed assertion.

Question 10: Where are private keys stored when using a platform authenticator such as Windows Hello or Apple Face ID?

In an HttpOnly cookie on the user's device
In the browser's IndexedDB local storage
On the FIDO relying party server
In the operating system's secure enclave or TPM (Correct answer)

Correct answer: In the operating system's secure enclave or TPM

Platform authenticators leverage hardware-backed secure storage like a TPM or Secure Enclave so private keys never leave the device in plaintext.

Question 11: Which test scenario specifically validates that a relying party rejects a registration response where the clientDataJSON origin does not match the expected origin?

User presence flag test
RPID hash mismatch test
Origin binding validation test (Correct answer)
Attestation trust path test

Correct answer: Origin binding validation test

Origin binding validation tests confirm that the server rejects registrations where the clientDataJSON origin differs from the expected relying party origin.

Question 12: In ECDSA signatures used by FIDO2, what is the mathematical basis that makes the private key computationally infeasible to recover from a signature?

The hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP) (Correct answer)
The difficulty of factoring large semiprime integers
The one-way property of SHA-256 applied to the key material
The difficulty of solving systems of multivariate polynomial equations

Correct answer: The hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP)

ECDSA security relies on the ECDLP: given a point Q = k·G on the curve, it is computationally infeasible to recover the scalar k (private key).

Question 13: Which versioning concern is most critical when updating a FIDO2 server library in production?

Removing legacy REST endpoints unrelated to FIDO
Ensuring the credential storage schema remains backward compatible (Correct answer)
Changing the UI color scheme
Upgrading the front-end JavaScript framework simultaneously

Correct answer: Ensuring the credential storage schema remains backward compatible

Changing how credentials are stored or parsed can invalidate existing registered credentials, locking out all FIDO users.

Question 14: What is the recommended maximum byte length for a FIDO2 credential_id that a relying party database column should accommodate?

64 bytes
4096 bytes
128 bytes
1023 bytes (Correct answer)

Correct answer: 1023 bytes

The WebAuthn specification states credential IDs can be up to 1023 bytes, so the column must accommodate at least that length.

Question 15: Which FIDO protocol enables two-factor authentication with security keys?

FIDO UAF
LDAP
OpenID Connect
FIDO U2F (Correct answer)

Correct answer: FIDO U2F

FIDO U2F (Universal Second Factor) is a specific FIDO protocol designed to add a strong second factor to existing password-based logins. It primarily uses external security keys (like USB, NFC, or Bluetooth devices) to provide cryptographic proof of user presence. This significantly enhances security against phishing and other online attacks by requiring a physical token in addition to a password.

Question 16: Which FIDO2 feature allows an authenticator to store a symmetric secret that is encrypted by the authenticator and returned only after a successful UV, useful for offline encryption use cases?

uvm extension
largeBlobKey extension
hmac-secret extension (Correct answer)
credProtect extension

Correct answer: hmac-secret extension

The hmac-secret extension lets the authenticator maintain a device-bound secret; it returns an HMAC output keyed with that secret only after successful user verification, enabling offline scenarios like disk encryption.

Question 17: During FIDO registration, what does the relying party do with the attestation statement?

It forwards it to the FIDO Alliance for auditing
It stores it as the user's credential ID for future authentication
It verifies it to establish trust in the authenticator model and its properties (Correct answer)
It discards it immediately to protect user privacy

Correct answer: It verifies it to establish trust in the authenticator model and its properties

The relying party verifies the attestation statement to determine the trustworthiness and properties of the authenticator model being registered.

Question 18: Which indexing strategy is most appropriate for a FIDO2 credential table expected to handle millions of authentication lookups per day?

Full-table scan on every lookup
B-tree index on credential_id (Correct answer)
Clustered index on creation_timestamp
Hash index on user display name

Correct answer: B-tree index on credential_id

A B-tree index on credential_id enables O(log n) lookups, making authentication queries fast at scale.

Question 19: In a WebAuthn registration call, what value should `publicKeyCredentialCreationOptions.rp.id` typically be set to?

The IP address of the origin server
The user's email address
A randomly generated GUID for the session
The effective domain of the relying party (Correct answer)

Correct answer: The effective domain of the relying party

The RP ID must be set to the effective domain (e.g., 'example.com') so the authenticator can bind the credential to that origin.

Question 20: Which FIDO specification defines how authenticators signal support for 'PIN/UV Auth Protocols' and negotiate which protocol version to use with the platform?

CTAP2 specification, authenticatorGetInfo response (pinUvAuthProtocols field) (Correct answer)
WebAuthn Level 2, Section 6.3
FIDO Metadata Service API v3
FIDO UAF Protocol Specification v1.2

Correct answer: CTAP2 specification, authenticatorGetInfo response (pinUvAuthProtocols field)

The CTAP2 authenticatorGetInfo command returns a pinUvAuthProtocols array listing supported PIN/UV auth protocol versions (1 and/or 2), allowing the platform to select a mutually supported version.

Question 21: Which FIDO2 extension allows an authenticator to report the method used for user verification (e.g., fingerprint vs. PIN)?

uvm (User Verification Method) (Correct answer)
credProtect
txAuthSimple
hmac-secret

Correct answer: uvm (User Verification Method)

The 'uvm' extension returns a matrix of user verification method descriptors indicating how the authenticator performed UV during the ceremony.

Question 22: When designing a FIDO2 credential database for GDPR compliance, how should user_handles be treated?

Store them in an external CDN for fast retrieval
Treat them as personal data and ensure they can be deleted on user request (Correct answer)
Share them with third-party analytics providers freely
Store them in plaintext for easy support lookups

Correct answer: Treat them as personal data and ensure they can be deleted on user request

User handles link credentials to user accounts and constitute personal data under GDPR, requiring the ability to delete them upon a subject access or erasure request.

Question 23: What is a key advantage of FIDO authentication?

It relies solely on knowledge-based authentication
It depends on one-time passwords sent via email
It eliminates phishing risks (Correct answer)
It requires passwords for added security

Correct answer: It eliminates phishing risks

A key advantage of FIDO authentication is that it eliminates phishing risks. Unlike passwords, FIDO credentials are cryptographically bound to specific websites and cannot be tricked into being entered on a fake site. The user's private key never leaves their device, and the authentication process verifies the legitimate origin of the request, making phishing attacks ineffective.

Question 24: Which security concept does FIDO's per-relying-party credential isolation implement?

Privilege escalation prevention
Key escrow
Compartmentalization (Correct answer)
Mandatory integrity control

Correct answer: Compartmentalization

Each FIDO credential is scoped to exactly one relying party, so compromise or misuse at one site cannot affect credentials registered at other sites — a form of compartmentalization.

Question 25: When deploying a FIDO2 relying party, which origin binding mechanism ensures that credentials cannot be used on phishing sites?

TLS certificate pinning only
IP address allowlisting
Cookie-based session tokens
The rpId bound to the registered domain origin (Correct answer)

Correct answer: The rpId bound to the registered domain origin

FIDO2 binds credentials to the relying party ID (rpId), which is tied to the origin domain, making phishing impossible because credentials are cryptographically tied to the legitimate site.

Question 26: Which component is essential in FIDO authentication?

Centralized password storage
Shared user credentials
CAPTCHA validation
FIDO authenticator (Correct answer)

Correct answer: FIDO authenticator

The FIDO authenticator is an essential component in FIDO authentication. This is the device or software that performs the cryptographic operations and verifies the user's identity locally. It can be a built-in biometric sensor (like a fingerprint reader), a hardware security key, or a software authenticator on a mobile device, holding the user's private key securely.

Question 27: Which cryptographic algorithm identifier should the FIDO2 credential database store alongside the public key to correctly verify future assertions?

RSA key size in bits
COSE algorithm identifier (e.g., -7 for ES256) (Correct answer)
SHA-1 digest identifier
MD5 hash algorithm

Correct answer: COSE algorithm identifier (e.g., -7 for ES256)

The COSE algorithm identifier specifies how the public key must be used for verification, and it must be persisted with the credential record.

Question 28: An incident response team discovers that an attacker has stolen the relying party's server-side credential database. What is the direct impact on user security?

The attacker can forge attestation statements for new registrations
The attacker can immediately authenticate as any user
All user passwords are also exposed because they are stored alongside credentials
The attacker gains public keys only, which cannot be used to authenticate without the corresponding private key (Correct answer)

Correct answer: The attacker gains public keys only, which cannot be used to authenticate without the corresponding private key

FIDO2 credential records contain public keys; without the private key held by the authenticator, stolen records cannot be used for authentication.

Question 29: Which of the following is a FIDO-supported authentication factor?

Security questions
Hardware security keys (Correct answer)
Username and password
SMS one-time passwords

Correct answer: Hardware security keys

Hardware security keys are a core FIDO-supported authentication factor. These physical devices, often resembling USB drives, securely store cryptographic keys used for authentication. They provide a strong, phishing-resistant method for verifying a user's identity, either as a second factor or as a complete passwordless solution, by requiring physical presence and user interaction.

Question 30: How does FIDO2 complement a federated identity system that uses OpenID Connect (OIDC)?

FIDO2 issues JWT access tokens
FIDO2 replaces OIDC tokens entirely
FIDO2 provides the authorization server role in OIDC
FIDO2 can serve as the authentication factor at the IdP, strengthening the OIDC login (Correct answer)

Correct answer: FIDO2 can serve as the authentication factor at the IdP, strengthening the OIDC login

FIDO2 can be used as the authentication mechanism at an OIDC Identity Provider, ensuring the login step is phishing-resistant before the IdP issues tokens to relying parties.

FIDO Certified Professional (FCP)

The FIDO Certified Professional (FCP) certification validates expertise in designing, implementing, and deploying FIDO authentication solutions, covering business requirements analysis, technical implementation, and FIDO protocol standards.

Questions

35 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds