The FIDO Certified Professional (FCP) exam is for people who design, deploy and explain FIDO authentication, and it is delivered at Pearson VUE test centers. This page gives you the published exam facts, a map of the official content areas to our free practice sets, worked sample questions, a study plan and answers to common candidate questions.

FCP Exam at a Glance

What changed for FCP in 2026

• Nov 1, 2026: Score release changed to Pass/Fail; results delayed approximately 30-60 days (previously Pass/Fail; results delayed ~30-60 days).^[1]

What the FCP is and how it works

According to FIDO Alliance, “The FIDO Certified Professional shall have at least two to four (2-4) years of industry experience in at least three (3) of the five (5) domains of knowledge.”^[1]

The FCP credential is issued by the FIDO Alliance for professionals who work with FIDO authentication solutions. The exam is computer-based and taken at Pearson VUE testing centers, so you schedule a seat at a center rather than sitting it at home.

Eligibility is based on experience. The candidate handbook says a FIDO Certified Professional should have at least 2-4 years of industry experience in at least 3 of the 5 domains of knowledge. Read the handbook wording yourself before you apply, because it decides whether your background qualifies.

The initial exam fee is $550 for FIDO members and $750 for non-members. Results are reported as Pass/Fail, and they are delayed approximately 30-60 days so the cut score can be set. Plan around that wait instead of expecting a result on the day.

If you do not pass, you can retake the exam after 90 days, and each retest costs $150. After a third failure you must wait 180 days and reapply.

Once certified, the cycle lasts 3 years. You must earn 90 CPE credits over that cycle, report them annually, and pay a $125 annual maintenance fee. Fees and rules can change, so confirm the current details in the official FCP candidate handbook and with the FIDO Alliance. Our practice questions are written by us with AI tools and are not real exam questions.

FCP content outline and where to practise each area

The content areas below are copied from the official FCP content outline published by FIDO Alliance, with the share of the exam each area carries. The right-hand column shows which of our practice sets covers it.

Worked examples: how to reason through FCP questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: What is the main advantage of a linked list over an array?

1. Efficient insertion and deletion without shifting elements
2. Faster random access to elements
3. Less memory usage per element
4. Simpler implementation

Answer: A. Efficient insertion and deletion without shifting elements

Explanation:

The correct answer is that a linked list allows efficient insertion and deletion without shifting elements. Each node holds a reference to the next one, so adding or removing a node at a known position only means updating references. An array stores items side by side, so inserting in the middle forces later items to move.

Faster random access is the array's strength, not the list's, because an array can jump straight to an index while a list must be walked node by node. Less memory per element is wrong because every node carries extra reference data. Simpler implementation is wrong because pointer handling is usually more error-prone than indexing.

Rule to remember: arrays favour fast reads by position, linked lists favour cheap structural changes.

Example 2

Question: What privacy consideration arises when a relying party uses the same credential ID across multiple services operated by the same organization?

1. Credential IDs are publicly visible and could be used to correlate a user's activity across those services
2. Credential IDs are always hashed, so there is no privacy risk
3. Using the same ID improves security through key reuse
4. It has no impact as credential IDs are server-side only

Answer: A. Credential IDs are publicly visible and could be used to correlate a user's activity across those services

Explanation:

The correct answer is that credential IDs can be visible and so could be used to correlate a user's activity across services. If the same identifier shows up in several places, it behaves like a tracking handle, even when the services belong to one organization.

The claim that IDs are always hashed is wrong, because nothing ensures that and the ID is exchanged during authentication. The claim that reuse improves security through key reuse is wrong, because sharing an identifier adds no protection and works against the privacy design of FIDO. The claim that it has no impact because IDs are server-side only is wrong, because the ID passes through the client and can be observed.

Rule to remember: keep credentials scoped to a single relying party so one identifier cannot link a person across services.

Example 3

Question: What is the purpose of version control in software development?

1. To track changes, enable collaboration, and maintain code history
2. To backup files to an external drive
3. To count the number of lines of code written
4. To monitor developer productivity

Answer: A. To track changes, enable collaboration, and maintain code history

Explanation:

The correct answer is that version control tracks changes, enables collaboration and maintains code history. Every change is recorded with who made it and why, so a team can work on the same code, compare versions and return to an earlier state when something breaks.

Backing files up to an external drive is wrong because a backup copies files but does not record meaningful change history or support merging work. Counting lines of code is wrong because line totals say nothing about quality or about how the code evolved. Monitoring developer productivity is wrong because version control is not designed as a measurement tool, even though its history can be inspected.

Rule to remember: version control is about history and coordination, not storage or surveillance.

How to use these practice tests

Start with the official FCP candidate handbook and the exam outline, and write down each content area in your own words. Then check the experience requirement against your background, since it affects when you should apply.

Next, take a practice set for each area using the blueprint table above. Begin with the FIDO-specific sets on protocols and standards, authentication methods, attestation and metadata, and public-key cryptography. After each set, read the explanation for every question you missed, not only the ones you got wrong by a wide margin, and note the rule behind the answer.

Then move to the supporting sets on identity and access management, security principles, system architecture, testing and quality assurance, and implementation and deployment. These matter because the exam asks you to analyze, design, validate and deploy, not just recall definitions.

Keep a short list of weak topics. Return to them after a few days and retry the matching questions without looking at your notes. If a topic still feels shaky, go back to the official material instead of memorizing our answers.

Close your preparation by mixing sets in a single sitting so you practise switching between design, deployment and explanation questions. Book your Pearson VUE appointment only once your results in every area feel steady, and remember that the official result will take time to arrive.

Sources & last verified

1. pearsonvue.com — exam fee, retake fee, retake policy, validity (official source). “Initial exam fees for FIDO Member participants are $550 and $750 for nonFIDO Member participants.” Verified Nov 1, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.