FCP Identity and Access Management Flashcards

Which FIDO2 authenticator selection criteria option should an enterprise relying party use when hardware security keys are required for compliance?

Answer: authenticatorAttachment: 'cross-platform'

Setting authenticatorAttachment to 'cross-platform' restricts registration to roaming authenticators such as hardware security keys, excluding built-in platform authenticators.

How does FIDO2 authentication interact with SAML-based SSO in a typical enterprise deployment?

Answer: FIDO2 is used at the SAML Identity Provider to authenticate the user before issuing a SAML assertion to service providers

In enterprise SSO, FIDO2 secures the IdP login step; once authenticated via FIDO2, the IdP issues standard SAML assertions to connected service providers.

What is 'step-up authentication' in the context of FIDO2 and IAM?

Answer: Requiring an additional or stronger FIDO2 assertion when a user attempts a high-risk action

Step-up authentication prompts the user to re-verify with a FIDO2 credential when a sensitive operation is requested, even if they already have an active session.

In FIDO UAF (the predecessor protocol), what term describes a transaction that requires the user to explicitly confirm a specific action using their authenticator?

Answer: Transaction confirmation

UAF transaction confirmation presents a human-readable transaction description to the user, who must actively confirm it with their authenticator, binding the authentication to the specific action.

Which risk does storing FIDO credential IDs in plaintext server logs introduce?

Answer: Credential IDs could be used in targeted authentication probing to identify registered users

While credential IDs are not secret, logging them in plaintext could allow attackers who access logs to probe for specific users' registered credentials.

What is the purpose of the 'timeout' parameter in a FIDO2 PublicKeyCredentialRequestOptions object?

Answer: To specify how long the browser should wait for user interaction before aborting the authentication ceremony

The timeout parameter tells the browser how many milliseconds to wait for the user to interact with their authenticator before the ceremony is aborted, improving UX without leaving open-ended prompts.