Mixed Deck — All FCP Topics Flashcards

What is the purpose of the 'timeout' parameter in a FIDO2 PublicKeyCredentialRequestOptions object?

Answer: To specify how long the browser should wait for user interaction before aborting the authentication ceremony

The timeout parameter tells the browser how many milliseconds to wait for the user to interact with their authenticator before the ceremony is aborted, improving UX without leaving open-ended prompts.

Why is FIDO authentication considered user-friendly?

Answer: It eliminates password fatigue

FIDO authentication is considered user-friendly because it eliminates password fatigue, which stems from the need to remember complex passwords, change them frequently, and manage multiple credentials. By enabling passwordless logins using familiar gestures like biometrics or PINs, FIDO offers a much simpler, faster, and more intuitive user experience. This convenience encourages stronger security adoption.

What is the main feature of FIDO2?

Answer: It enables passwordless authentication

FIDO2 is the latest generation of FIDO specifications, building upon its predecessors to enable robust passwordless authentication experiences across various platforms and devices. By integrating with web browsers and operating systems via WebAuthn, FIDO2 allows users to log in securely using biometrics, PINs, or external security keys without ever typing a password. This eliminates the vulnerabilities associated with passwords and improves user convenience.

Why is stakeholder management important in projects?

Answer: Because stakeholder support and engagement are critical to project success

Identifying and managing stakeholder expectations helps ensure support, resources, and alignment with project goals.

What does 'none' attestation convey in WebAuthn?

Answer: No attestation information is provided, making it impossible to verify the authenticator's origin

The 'none' attestation format means the authenticator provides no statement about its provenance, so the relying party cannot determine what kind of authenticator was used.

What is encryption?

Answer: Converting data into a coded format that can only be read with the correct key

Encryption transforms readable data into an unreadable format, protecting it from unauthorized access even if intercepted.

Why is root cause analysis important in quality improvement?

Answer: It identifies the underlying cause of problems rather than just symptoms

Root cause analysis goes beyond surface-level symptoms to identify fundamental causes, enabling effective and lasting solutions.

What is the DRY principle in programming?

Answer: Dont Repeat Yourself — avoid code duplication

DRY means every piece of knowledge should have a single, unambiguous representation in a system, reducing redundancy.

In a zero-trust architecture, how does FIDO2 authentication support continuous verification principles?

Answer: By providing strong, hardware-bound authentication assertions that can satisfy step-up auth requests

FIDO2 assertions are cryptographically strong and hardware-bound, making them suitable for satisfying step-up authentication challenges in zero-trust environments that require continuous verification.

What is the main advantage of a linked list over an array?

Answer: Efficient insertion and deletion without shifting elements

Linked lists allow O(1) insertion and deletion at known positions without moving other elements, unlike arrays.

Which database isolation level is recommended when reading and updating the sign_count during FIDO2 authentication to prevent phantom reads?

Answer: SERIALIZABLE

SERIALIZABLE isolation prevents concurrent transactions from reading stale sign_count values that could allow a replay attack to succeed.

What is the primary IAM benefit of replacing passwords with FIDO passkeys for enterprise employees?

Answer: Removing the password attack surface (phishing, credential stuffing, reuse)

Passkeys eliminate passwords, removing the primary vector for phishing, credential stuffing, and password reuse attacks that compromise enterprise accounts.

When archiving deactivated FIDO2 credentials, which practice aligns with both security and auditability requirements?

Answer: Soft delete with a deactivated_at timestamp and retain for the audit period

Soft deletes preserve audit trails while preventing the credential from being used, satisfying both security and compliance needs.

Which cryptographic algorithm is most commonly used in packed attestation for signing the attestation statement?

Answer: ECDSA with the P-256 curve and SHA-256 (ES256)

Packed attestation commonly uses ECDSA P-256 / SHA-256 (COSE algorithm ES256) because it provides strong security with small key sizes and efficient computation on authenticator hardware.

A FIDO2 relying party experiences a database breach. Which stored credential field poses the greatest risk if exposed to an attacker?

Answer: credential_id

The credential_id, combined with the RP's allowCredentials list, can be used in targeted phishing; however, the public key alone cannot be used to authenticate without the private key on the authenticator.

Which attestation type provides the strongest assurance that an authenticator is genuine and meets specific security requirements during registration?

Answer: Full (basic) attestation

Full (basic) attestation uses a manufacturer-issued certificate chain to cryptographically prove the authenticator's make and model, providing the strongest assurance of device authenticity.

What is a VPN?

Answer: A Virtual Private Network that creates an encrypted connection over a public network

A VPN creates a secure, encrypted tunnel over a public network, protecting data privacy and enabling remote access.

What is the primary benefit of public-key cryptography in FIDO authentication?

Answer: It eliminates shared secrets

Public-key cryptography in FIDO eliminates the need for shared secrets, such as passwords, between the user and the service provider. Instead, the user's device proves identity by signing a challenge with its private key, which the service verifies using the publicly registered key. This design prevents credential theft from server breaches and phishing attacks, as no secret is ever transmitted or stored on the server.

What is the purpose of the 'fmt' field in a WebAuthn attestation object?

Answer: It identifies the attestation statement format so the relying party knows how to parse and verify it

The 'fmt' field names the attestation statement format (e.g., 'packed', 'tpm', 'fido-u2f'), which the relying party uses to select the correct verification algorithm and parser.

What is the purpose of unit testing?

Answer: To verify that individual components of code work correctly in isolation

Unit tests verify individual components in isolation, catching bugs early and making code more maintainable.