Practice Test Geeks(FCP) FIDO Certified Professional Practice Test
← All FCP Flashcard Decks

Database Management Flashcards

7 cards from real FCP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Database Management flashcards as text

  1. A relying party's credential database stores the 'aaguid'. What is the primary purpose of persisting this value?

    Answer: To identify the authenticator model for policy enforcement and display

    The AAGUID (Authenticator Attestation GUID) identifies the authenticator model, enabling RPs to enforce policies like requiring FIPS-certified devices.

  2. Which database isolation level is recommended when reading and updating the sign_count during FIDO2 authentication to prevent phantom reads?

    Answer: SERIALIZABLE

    SERIALIZABLE isolation prevents concurrent transactions from reading stale sign_count values that could allow a replay attack to succeed.

  3. In a multi-tenant FIDO2 platform, why must each tenant's credentials be logically isolated at the database level?

    Answer: To prevent one tenant's credential_ids from conflicting with or leaking to another tenant

    Without logical isolation, credential lookups could cross tenant boundaries, creating both data leakage and potential authentication bypass risks.

  4. What is the recommended maximum byte length for a FIDO2 credential_id that a relying party database column should accommodate?

    Answer: 1023 bytes

    The WebAuthn specification states credential IDs can be up to 1023 bytes, so the column must accommodate at least that length.

  5. A FIDO2 relying party wants to support multiple credentials per user. How should the database schema represent this relationship?

    Answer: Create a separate credentials table with a foreign key referencing the users table

    A separate credentials table with a user foreign key is the normalized approach that scales cleanly and supports efficient per-user credential queries.

  6. When a FIDO2 authenticator is reported lost, what database operation should the relying party perform on that credential record?

    Answer: Set a revoked flag or status and record the revocation timestamp

    Marking the credential as revoked with a timestamp preserves the audit trail while immediately preventing its use for authentication.

  7. Which stored credential field is compared byte-for-byte during the WebAuthn assertion verification process?

    Answer: stored public key

    The stored public key is used to verify the cryptographic signature in the authenticator's assertion response, requiring exact byte-level comparison.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. pearsonvue.com — Test delivery, eligibility, fees, renewal, retake fee, retake policy, score release, score validity, exam information · verified Nov 2026