FCP Identity and Access Management Flashcards

What FIDO concept ensures that a credential registered on example.com cannot be used to authenticate on attacker.com?

Answer: Cryptographic origin binding via the relying party ID

Credentials are cryptographically bound to the relying party ID (rpId), which maps to a specific origin, making cross-site credential use cryptographically impossible.

In enterprise IAM, what is 'device-bound passkey' compared to a 'synced passkey'?

Answer: Device-bound passkeys never leave the device's secure enclave; synced passkeys are shared across a user's devices

Device-bound passkeys are hardware-bound and non-exportable (highest security), while synced passkeys are backed up to cloud keychains and can roam across a user's devices.

Which FIDO Alliance document defines conformance requirements that Identity Providers must meet to be listed as a FIDO Certified IdP?

Answer: FIDO Certified IdP Program Requirements and Test Plan

The FIDO Certified IdP Program Requirements and Test Plan defines the conformance criteria that Identity Providers must satisfy to earn FIDO certification.

What is the function of the 'allowCredentials' list sent by a relying party during a FIDO2 authentication request?

Answer: To specify which credentials the server will accept for a given user, reducing discovery scope

The allowCredentials list tells the authenticator which credential IDs are acceptable for the given user, enabling the authenticator to select the correct key without exposing other users' credentials.

When integrating FIDO2 with a SCIM-based provisioning system, which event should trigger removal of a user's FIDO credentials from the relying party?

Answer: SCIM deprovision/delete event for the user account

A SCIM deprovision or delete event signals that the user's access should be revoked; all associated FIDO credentials must be deleted to prevent orphaned access.

What privacy consideration arises when a relying party uses the same credential ID across multiple services operated by the same organization?

Answer: Credential IDs are publicly visible and could be used to correlate a user's activity across those services

If the same credential ID is visible across services, it can act as a tracker; FIDO2 recommends per-relying-party credential IDs to prevent cross-service correlation.