FCP Identity and Access Management Flashcards

Which FIDO2 feature enables a user to authenticate without first providing a username, improving the sign-in UX?

Answer: Discoverable credentials (resident keys) with conditional UI

Discoverable credentials stored on the authenticator combined with WebAuthn's conditional UI allow users to authenticate without entering a username, creating a truly passwordless experience.

How does FIDO2 complement a federated identity system that uses OpenID Connect (OIDC)?

Answer: FIDO2 can serve as the authentication factor at the IdP, strengthening the OIDC login

FIDO2 can be used as the authentication mechanism at an OIDC Identity Provider, ensuring the login step is phishing-resistant before the IdP issues tokens to relying parties.

What is the primary IAM benefit of replacing passwords with FIDO passkeys for enterprise employees?

Answer: Removing the password attack surface (phishing, credential stuffing, reuse)

Passkeys eliminate passwords, removing the primary vector for phishing, credential stuffing, and password reuse attacks that compromise enterprise accounts.

In a zero-trust architecture, how does FIDO2 authentication support continuous verification principles?

Answer: By providing strong, hardware-bound authentication assertions that can satisfy step-up auth requests

FIDO2 assertions are cryptographically strong and hardware-bound, making them suitable for satisfying step-up authentication challenges in zero-trust environments that require continuous verification.

What is account recovery's greatest challenge in a passwordless FIDO deployment?

Answer: Providing secure re-enrollment when a user loses all registered authenticators

Account recovery is the hardest problem because the fallback path (if all authenticators are lost) can become the weakest link and potentially undermine FIDO's phishing resistance.

Which approach is recommended for users who register multiple authenticators under the same FIDO2 account?

Answer: Independently registering each authenticator, storing separate public keys per credential

Each authenticator should be independently registered, creating a separate credential with its own key pair, so losing one device does not compromise credentials on others.