FIDO Certified Professional (FCP) — Questions and Answers

Question 1: What does the FIDO Metadata Service (MDS) primarily provide to relying parties?

A certificate revocation list for compromised user identities
A directory of registered FIDO relying parties and their policies
Metadata statements describing authenticator properties, certifications, and trust anchors (Correct answer)
Real-time credential revocation status for individual user accounts

Correct answer: Metadata statements describing authenticator properties, certifications, and trust anchors

The FIDO MDS provides metadata statements that describe authenticator capabilities, certification level, and the root certificates needed to verify attestation signatures.

Question 2: What is the role of the 'aaguid' field in FIDO2 authenticator data?

The user's unique identifier on the relying party
An encrypted session token
A 16-byte identifier for the authenticator model, used to look up metadata (Correct answer)
A globally unique ID for the individual credential

Correct answer: A 16-byte identifier for the authenticator model, used to look up metadata

The AAGUID (Authenticator Attestation GUID) identifies the authenticator model (not the individual device), allowing the relying party to look up its metadata and capabilities.

Question 3: Which WebAuthn attestation conveyance preference allows the client platform to decide how to provide attestation, potentially using an Anonymization CA?

direct
indirect (Correct answer)
enterprise
none

Correct answer: indirect

The 'indirect' conveyance preference gives the client discretion over how attestation is delivered, which may include routing it through an Anonymization CA to protect user privacy while maintaining trust.

Question 4: What key improvement does FIDO MDS version 3 (MDS3) introduce compared to MDS2?

It uses a signed JWT blob format with improved metadata structure and enhanced revocation handling (Correct answer)
It eliminates the need for authenticator manufacturer certification requirements
It replaces X.509 certificates with symmetric key attestation for simpler deployment
It adds a password-based fallback for authenticators that fail attestation

Correct answer: It uses a signed JWT blob format with improved metadata structure and enhanced revocation handling

MDS3 distributes metadata as a signed JWT blob, providing better revocation support, a more structured format, and a more scalable distribution mechanism than MDS2's individual JSON files.

Question 5: When integrating FIDO2 with a SCIM-based provisioning system, which event should trigger removal of a user's FIDO credentials from the relying party?

User's session timeout
SCIM deprovision/delete event for the user account (Correct answer)
User password change
Certificate expiry notification

Correct answer: SCIM deprovision/delete event for the user account

A SCIM deprovision or delete event signals that the user's access should be revoked; all associated FIDO credentials must be deleted to prevent orphaned access.

Question 6: What is a critical path in project management?

The shortest possible path to completion
The path requiring the most resources
The most expensive phase of the project
The longest sequence of dependent tasks that determines project duration (Correct answer)

Correct answer: The longest sequence of dependent tasks that determines project duration

The critical path identifies the sequence of tasks that directly affects the project completion date — any delay on these tasks delays the entire project.

Question 7: What is a key performance indicator (KPI)?

A customer complaint form
A measurable value that demonstrates effectiveness in achieving objectives (Correct answer)
A financial metric used only for budgeting
A staff scheduling tool

Correct answer: A measurable value that demonstrates effectiveness in achieving objectives

KPIs are quantifiable measures that help organizations track progress toward their strategic and operational goals.

Question 8: What is the purpose of version control in software development?

To monitor developer productivity
To backup files to an external drive
To count the number of lines of code written
To track changes, enable collaboration, and maintain code history (Correct answer)

Correct answer: To track changes, enable collaboration, and maintain code history

Version control systems track all code changes, enabling team collaboration and providing a complete history of modifications.

Question 9: Why is staying current with industry developments important for FCP professionals?

Only academic researchers need to stay current
Developments in the field are rarely significant
The field evolves and practitioners must adapt to provide quality service (Correct answer)
Current knowledge is only important for exam preparation

Correct answer: The field evolves and practitioners must adapt to provide quality service

Fields continuously evolve with new research, technology, and best practices that affect professional competency.

Question 10: During FIDO2 registration, what is the purpose of the 'challenge' parameter provided by the relying party?

To identify the user account
To prevent replay attacks by ensuring each registration is unique (Correct answer)
To set the credential timeout value
To specify the allowed authenticator types

Correct answer: To prevent replay attacks by ensuring each registration is unique

The challenge is a random nonce that prevents replay attacks by ensuring the authenticator signs a unique value for each registration or authentication ceremony.

Question 11: Why must the sign_count value in a FIDO2 credential record be updated atomically with its validation check?

To comply with GDPR data minimization rules
To ensure the counter resets on each authentication
To prevent race conditions that could allow replay attacks (Correct answer)
To reduce database write latency

Correct answer: To prevent race conditions that could allow replay attacks

Atomic read-validate-write of the sign_count prevents concurrent requests from exploiting a window where a replayed assertion could pass.

Question 12: What is the maximum number of resident keys (discoverable credentials) typically supported by a hardware security key?

Unlimited, stored in cloud backup
Exactly 1 credential per site
10,000 credentials via extended memory
Typically 25–50 credentials depending on the device (Correct answer)

Correct answer: Typically 25–50 credentials depending on the device

Hardware security keys have limited secure storage and typically support 25–50 discoverable (resident) credentials depending on the manufacturer and model.

Question 13: What does 'none' attestation convey in WebAuthn?

An error state indicating the authenticator failed its self-test before attesting
No attestation information is provided, making it impossible to verify the authenticator's origin (Correct answer)
A deprecated format that has been replaced by packed attestation in modern deployments
An attestation type reserved exclusively for platform authenticators built into devices

Correct answer: No attestation information is provided, making it impossible to verify the authenticator's origin

The 'none' attestation format means the authenticator provides no statement about its provenance, so the relying party cannot determine what kind of authenticator was used.

Question 14: Which database isolation level is recommended when reading and updating the sign_count during FIDO2 authentication to prevent phantom reads?

READ COMMITTED
READ UNCOMMITTED
SERIALIZABLE (Correct answer)
REPEATABLE READ

Correct answer: SERIALIZABLE

SERIALIZABLE isolation prevents concurrent transactions from reading stale sign_count values that could allow a replay attack to succeed.

Question 15: A FIDO2 RP database needs to prevent two concurrent registrations from inserting the same credential_id. Which mechanism is most reliable?

Manual admin review of duplicate submissions
UNIQUE database constraint on credential_id with transaction rollback on conflict (Correct answer)
Application-layer mutex lock
Periodic batch deduplication job

Correct answer: UNIQUE database constraint on credential_id with transaction rollback on conflict

A database-enforced UNIQUE constraint guarantees atomicity at the storage layer, eliminating race conditions that application locks cannot fully prevent.

Question 16: What is typically required to maintain FCP certification?

Paying fees without any additional requirements
Nothing once initial certification is obtained
Retaking the full certification exam annually
Completing continuing education credits and meeting renewal requirements (Correct answer)

Correct answer: Completing continuing education credits and meeting renewal requirements

Most certifications require ongoing professional development to ensure practitioners stay current in their field.

Question 17: What is an algorithm?

A hardware component of a computer
A type of programming language
A network protocol
A step-by-step procedure for solving a problem or accomplishing a task (Correct answer)

Correct answer: A step-by-step procedure for solving a problem or accomplishing a task

An algorithm is a finite sequence of well-defined instructions for solving a specific problem or performing a computation.

Question 18: How does a relying party use an authenticator's AAGUID in relation to the FIDO Metadata Service?

The relying party uses the AAGUID as a lookup key to retrieve the authenticator's metadata statement from the MDS (Correct answer)
The MDS assigns and distributes AAGUIDs to authenticator manufacturers upon certification
The AAGUID replaces the MDS entirely in FIDO2, eliminating the need for a centralized metadata repository
The MDS generates a new AAGUID for each registration event to ensure per-credential uniqueness

Correct answer: The relying party uses the AAGUID as a lookup key to retrieve the authenticator's metadata statement from the MDS

The AAGUID extracted from authenticator data during registration is used as a primary key to query the FIDO MDS and retrieve the metadata statement for that specific authenticator model.

Question 19: Which cryptographic algorithm is most commonly used in packed attestation for signing the attestation statement?

HMAC-SHA256 using a symmetric secret shared with the manufacturer
ECDSA with the P-256 curve and SHA-256 (ES256) (Correct answer)
RC4 with a 128-bit key for fast computation on constrained hardware
RSA-1024 with SHA-1 for compatibility with legacy systems

Correct answer: ECDSA with the P-256 curve and SHA-256 (ES256)

Packed attestation commonly uses ECDSA P-256 / SHA-256 (COSE algorithm ES256) because it provides strong security with small key sizes and efficient computation on authenticator hardware.

Question 20: What is the purpose of the 'fmt' field in a WebAuthn attestation object?

It specifies the encoding format used to serialize the credential public key
It defines which version of the WebAuthn specification the client platform supports
It identifies the attestation statement format so the relying party knows how to parse and verify it (Correct answer)
It indicates the firmware version currently running on the authenticator hardware

Correct answer: It identifies the attestation statement format so the relying party knows how to parse and verify it

The 'fmt' field names the attestation statement format (e.g., 'packed', 'tpm', 'fido-u2f'), which the relying party uses to select the correct verification algorithm and parser.

Question 21: Which technology does FIDO use to enhance authentication security?

Username and password
Public-key cryptography (Correct answer)
Symmetric encryption
SMS-based OTPs

Correct answer: Public-key cryptography

FIDO authentication fundamentally relies on public-key cryptography, also known as asymmetric cryptography. This technology uses a pair of mathematically linked keys – a private key stored securely on the user's device and a public key registered with the online service – to cryptographically prove user identity without transmitting any secrets. This design makes FIDO highly resistant to credential theft and phishing.

Question 22: Which attestation type provides the strongest assurance that an authenticator is genuine and meets specific security requirements during registration?

Self attestation
Surrogate attestation
Full (basic) attestation (Correct answer)
None attestation

Correct answer: Full (basic) attestation

Full (basic) attestation uses a manufacturer-issued certificate chain to cryptographically prove the authenticator's make and model, providing the strongest assurance of device authenticity.

Question 23: Which standard is associated with FIDO2 authentication?

RADIUS
SAML
WebAuthn (Correct answer)
OAuth 1.0

Correct answer: WebAuthn

WebAuthn (Web Authentication) is a core component of FIDO2, developed by the FIDO Alliance and W3C. It defines a standard web API that allows web applications to integrate FIDO authentication directly into browsers and operating systems. This enables strong, phishing-resistant, and passwordless authentication experiences for users across the web.

Question 24: Which of the following is a FIDO-supported authentication factor?

Username and password
SMS one-time passwords
Hardware security keys (Correct answer)
Security questions

Correct answer: Hardware security keys

Hardware security keys are a core FIDO-supported authentication factor. These physical devices, often resembling USB drives, securely store cryptographic keys used for authentication. They provide a strong, phishing-resistant method for verifying a user's identity, either as a second factor or as a complete passwordless solution, by requiring physical presence and user interaction.

Question 25: A FIDO2 credential database schema includes an 'attestation_object' column. Why might the RP choose to persist this binary blob?

To store the user's biometric data securely
To use it as a session token for subsequent logins
To generate new credentials without requiring the authenticator
To re-verify attestation at a later time or to support audits requiring proof of authenticator authenticity (Correct answer)

Correct answer: To re-verify attestation at a later time or to support audits requiring proof of authenticator authenticity

Persisting the attestation object allows the RP to re-verify the authenticator's certification status if trust anchors are updated after initial registration.

Question 26: Which cryptographic method does FIDO use for authentication?

Token-based authentication
Symmetric encryption
Hashing algorithms
Asymmetric cryptography (Correct answer)

Correct answer: Asymmetric cryptography

FIDO authentication uses asymmetric cryptography, which is another term for public-key cryptography. This method involves a pair of keys: a private key kept secret on the user's device and a public key shared with the online service. This allows for secure challenge-response authentication where the private key never leaves the device, making it highly resistant to credential theft and impersonation.

Question 27: What is the primary IAM benefit of replacing passwords with FIDO passkeys for enterprise employees?

Removing the password attack surface (phishing, credential stuffing, reuse) (Correct answer)
Eliminating the need for multi-factor authentication entirely
Reducing the number of user accounts needed
Enabling anonymous authentication

Correct answer: Removing the password attack surface (phishing, credential stuffing, reuse)

Passkeys eliminate passwords, removing the primary vector for phishing, credential stuffing, and password reuse attacks that compromise enterprise accounts.

Question 28: What is the purpose of a work breakdown structure (WBS)?

To track financial expenditures only
To assign blame for delays
To list all project team members
To decompose the project into smaller, manageable work packages (Correct answer)

Correct answer: To decompose the project into smaller, manageable work packages

A WBS hierarchically breaks down the total scope of work into smaller, defined deliverables that can be planned and managed.

Question 29: In a zero-trust architecture, how does FIDO2 authentication support continuous verification principles?

By removing the need for device health checks
By providing strong, hardware-bound authentication assertions that can satisfy step-up auth requests (Correct answer)
By sharing credentials across all enterprise services automatically
By issuing long-lived session cookies that bypass re-authentication

Correct answer: By providing strong, hardware-bound authentication assertions that can satisfy step-up auth requests

FIDO2 assertions are cryptographically strong and hardware-bound, making them suitable for satisfying step-up authentication challenges in zero-trust environments that require continuous verification.

Question 30: What is the role of a code of ethics in the FCP profession?

To guide professional behavior and protect the public interest (Correct answer)
To create legal liability
To standardize pricing for services
To restrict professional freedom

Correct answer: To guide professional behavior and protect the public interest

A code of ethics establishes expectations for professional conduct and serves as a guide for ethical decision-making.

Question 31: What is benchmarking in the context of quality improvement?

Reducing all metrics to a single score
Comparing performance against best practices or industry standards (Correct answer)
Eliminating competition between departments
Setting the lowest acceptable standard

Correct answer: Comparing performance against best practices or industry standards

Benchmarking involves comparing an organizations performance against recognized leaders or standards to identify improvement opportunities.

Question 32: What is the function of an Anonymization CA (AnonCA) in FIDO attestation?

It anonymizes the relying party's identity in attestation requests to protect business confidentiality
It re-signs authenticator attestation statements with a different certificate, preventing cross-site tracking while preserving trust (Correct answer)
It strips all attestation data from the credential before forwarding it to the relying party server
It issues anonymous user certificates that replace public keys for privacy-sensitive authentication scenarios

Correct answer: It re-signs authenticator attestation statements with a different certificate, preventing cross-site tracking while preserving trust

An Anonymization CA receives the authenticator's raw attestation and re-signs it with a fresh certificate, breaking the linkability between authenticator model certificates across relying parties while still providing verifiable attestation trust.

Question 33: Which biometric method is commonly used in FIDO authentication?

Voice recognition
Knowledge-based authentication
Fingerprint scanning (Correct answer)
Token-based authentication

Correct answer: Fingerprint scanning

Fingerprint scanning is a commonly used biometric method supported by FIDO authentication. FIDO authenticators can leverage built-in biometric sensors, such as fingerprint readers, to verify the user's presence and consent locally on their device. This allows for a convenient and secure authentication experience without transmitting the biometric data to a server.

Question 34: Which of the following fields is typically found in a FIDO Metadata Statement?

User credentials and their associated public keys for a given relying party
Session tokens, their associated scopes, and their expiration timestamps
Authenticator AAGUID, supported cryptographic algorithms, and attestation root certificates (Correct answer)
Relying party domain names and their per-site authentication security policies

Correct answer: Authenticator AAGUID, supported cryptographic algorithms, and attestation root certificates

A metadata statement contains the authenticator's AAGUID, supported COSE algorithm identifiers, certification status, and the root certificates required to verify that authenticator's attestation.

Question 35: Which FIDO Alliance document defines conformance requirements that Identity Providers must meet to be listed as a FIDO Certified IdP?

NIST SP 800-63B
WebAuthn Level 3 Editor's Draft
FIDO Certified IdP Program Requirements and Test Plan (Correct answer)
FIDO UAF Authenticator Transport Binding Profile

Correct answer: FIDO Certified IdP Program Requirements and Test Plan

The FIDO Certified IdP Program Requirements and Test Plan defines the conformance criteria that Identity Providers must satisfy to earn FIDO certification.

Question 36: Which cryptographic algorithm identifier should the FIDO2 credential database store alongside the public key to correctly verify future assertions?

RSA key size in bits
SHA-1 digest identifier
MD5 hash algorithm
COSE algorithm identifier (e.g., -7 for ES256) (Correct answer)

Correct answer: COSE algorithm identifier (e.g., -7 for ES256)

The COSE algorithm identifier specifies how the public key must be used for verification, and it must be persisted with the credential record.

Question 37: What is the purpose of unit testing?

To check network connectivity
To test the entire application at once
To measure code performance only
To verify that individual components of code work correctly in isolation (Correct answer)

Correct answer: To verify that individual components of code work correctly in isolation

Unit tests verify individual components in isolation, catching bugs early and making code more maintainable.

Question 38: In enterprise IAM, what is 'device-bound passkey' compared to a 'synced passkey'?

Device-bound passkeys are backed up to cloud; synced ones are not
Device-bound passkeys never leave the device's secure enclave; synced passkeys are shared across a user's devices (Correct answer)
Device-bound passkeys require a PIN; synced ones use biometrics
There is no difference between the two

Correct answer: Device-bound passkeys never leave the device's secure enclave; synced passkeys are shared across a user's devices

Device-bound passkeys are hardware-bound and non-exportable (highest security), while synced passkeys are backed up to cloud keychains and can roam across a user's devices.

Question 39: In a multi-tenant FIDO2 platform, why must each tenant's credentials be logically isolated at the database level?

To allow credential sharing between tenants for SSO
To reduce backup storage costs
To prevent one tenant's credential_ids from conflicting with or leaking to another tenant (Correct answer)
To comply with WebAuthn's mandatory sharding requirement

Correct answer: To prevent one tenant's credential_ids from conflicting with or leaking to another tenant

Without logical isolation, credential lookups could cross tenant boundaries, creating both data leakage and potential authentication bypass risks.

Question 40: What is the purpose of the OSI model?

To provide a standard framework for understanding network communications (Correct answer)
To monitor network performance only
To encrypt all network traffic
To replace all networking equipment

Correct answer: To provide a standard framework for understanding network communications

The OSI model provides a conceptual framework with seven layers that standardizes network communication functions.

Question 41: What privacy consideration arises when a relying party uses the same credential ID across multiple services operated by the same organization?

Credential IDs are publicly visible and could be used to correlate a user's activity across those services (Correct answer)
Credential IDs are always hashed, so there is no privacy risk
It has no impact as credential IDs are server-side only
Using the same ID improves security through key reuse

Correct answer: Credential IDs are publicly visible and could be used to correlate a user's activity across those services

If the same credential ID is visible across services, it can act as a tracker; FIDO2 recommends per-relying-party credential IDs to prevent cross-service correlation.

Question 42: What is the recommended approach for storing FIDO2 credential public keys on a relying party server?

Encrypt them with AES-256 and store in a flat file
Store them in a database associated with the user account (Correct answer)
Hash them with bcrypt before storing
Keep them only in browser local storage

Correct answer: Store them in a database associated with the user account

FIDO2 public keys must be stored server-side in a database associated with the user account so the relying party can verify authentication assertions.

Question 43: What does the 'requireResidentKey' (or 'residentKey: required') option in PublicKeyCredentialCreationOptions specify?

That the credential must be backed up to the cloud
That the credential must be stored on the authenticator as a discoverable credential (Correct answer)
That user verification is mandatory
That the credential cannot be exported

Correct answer: That the credential must be stored on the authenticator as a discoverable credential

Setting residentKey to 'required' instructs the authenticator to store the credential as a discoverable (resident) credential on-device, enabling usernameless login.

Question 44: Which methodology uses the Plan-Do-Study-Act cycle?

Continuous Quality Improvement (CQI) (Correct answer)
Root Cause Elimination
Statistical Process Control only
Lean Manufacturing exclusively

Correct answer: Continuous Quality Improvement (CQI)

The PDSA cycle is a cornerstone of CQI methodology, providing a structured approach to testing and implementing changes.

Question 45: Which stored credential field is compared byte-for-byte during the WebAuthn assertion verification process?

user_display_name
stored public key (Correct answer)
rp_name
aaguid

Correct answer: stored public key

The stored public key is used to verify the cryptographic signature in the authenticator's assertion response, requiring exact byte-level comparison.

Question 46: A FIDO2 relying party wants to support multiple credentials per user. How should the database schema represent this relationship?

Create a separate credentials table with a foreign key referencing the users table (Correct answer)
Store all credential_ids in a JSON array in the users table
Encode all credentials in a single Base64 string per user
Add numbered columns (credential_1, credential_2, ...) to the users table

Correct answer: Create a separate credentials table with a foreign key referencing the users table

A separate credentials table with a user foreign key is the normalized approach that scales cleanly and supports efficient per-user credential queries.

Question 47: What is the recommended maximum byte length for a FIDO2 credential_id that a relying party database column should accommodate?

4096 bytes
128 bytes
64 bytes
1023 bytes (Correct answer)

Correct answer: 1023 bytes

The WebAuthn specification states credential IDs can be up to 1023 bytes, so the column must accommodate at least that length.

Question 48: Which FIDO protocol enables two-factor authentication with security keys?

FIDO UAF
FIDO U2F (Correct answer)
LDAP
OpenID Connect

Correct answer: FIDO U2F

FIDO U2F (Universal Second Factor) is a specific FIDO protocol designed to add a strong second factor to existing password-based logins. It primarily uses external security keys (like USB, NFC, or Bluetooth devices) to provide cryptographic proof of user presence. This significantly enhances security against phishing and other online attacks by requiring a physical token in addition to a password.

Question 49: What is an AAGUID in the context of FIDO2 authenticators?

An Authenticator Attestation Globally Unique Identifier that identifies a specific authenticator model (Correct answer)
An Advanced Authentication Gateway Universal Identifier assigned to each relying party
An Asymmetric Algorithm Global Unique Index for cataloging cryptographic key types
An Access Authorization Group User ID assigned to a user during enrollment

Correct answer: An Authenticator Attestation Globally Unique Identifier that identifies a specific authenticator model

The AAGUID is a 128-bit identifier that uniquely identifies a specific model of authenticator, allowing relying parties to look up the corresponding metadata statement.

Question 50: What does 'enterprise attestation' in FIDO2 allow an organization to do that standard attestation does not?

Identify individual authenticator devices rather than just models (Correct answer)
Skip user verification for internal users
Reuse the same credential across multiple relying parties
Use shorter challenge lengths for performance

Correct answer: Identify individual authenticator devices rather than just models

Enterprise attestation allows organizations to identify individual authenticator devices (not just models), which is useful for asset tracking and compliance in enterprise environments.

Question 51: Which organization maintains the FIDO standards?

FIDO Alliance (Correct answer)
W3C
IETF
NIST

Correct answer: FIDO Alliance

The FIDO Alliance is an open industry association dedicated to developing and promoting open, royalty-free standards for simpler, stronger authentication. It was founded to address the lack of interoperability among strong authentication devices and to reduce the world's over-reliance on passwords. The Alliance continues to evolve and maintain the FIDO specifications, ensuring their widespread adoption and effectiveness.

Question 52: When a FIDO2 authenticator is reported lost, what database operation should the relying party perform on that credential record?

Delete the record permanently and issue a new credential_id
Update the sign_count to zero to invalidate future assertions
Move the record to a public log table for transparency
Set a revoked flag or status and record the revocation timestamp (Correct answer)

Correct answer: Set a revoked flag or status and record the revocation timestamp

Marking the credential as revoked with a timestamp preserves the audit trail while immediately preventing its use for authentication.

Question 53: Which FIDO2 authenticator selection criteria option should an enterprise relying party use when hardware security keys are required for compliance?

residentKey: 'preferred'
authenticatorAttachment: 'platform'
userVerification: 'discouraged'
authenticatorAttachment: 'cross-platform' (Correct answer)

Correct answer: authenticatorAttachment: 'cross-platform'

Setting authenticatorAttachment to 'cross-platform' restricts registration to roaming authenticators such as hardware security keys, excluding built-in platform authenticators.

Question 54: What should a FCP professional do when they encounter a situation beyond their competence?

Refer to a qualified specialist or seek additional training (Correct answer)
Attempt to handle it anyway
Ignore the situation
Delegate to an unlicensed assistant

Correct answer: Refer to a qualified specialist or seek additional training

Recognizing the limits of ones competence and making appropriate referrals is a fundamental professional responsibility.

Question 55: What is a phishing attack?

A social engineering attack using fraudulent communications to steal sensitive information (Correct answer)
A type of network scanning tool
A denial of service attack
A physical security breach

Correct answer: A social engineering attack using fraudulent communications to steal sensitive information

Phishing uses deceptive emails, messages, or websites to trick users into revealing sensitive information like passwords or financial data.

Question 56: Which metadata service should relying parties query to validate authenticator attestations and check for security advisories?

NIST National Vulnerability Database
Microsoft Azure Attestation Service
FIDO Alliance Metadata Service (MDS) (Correct answer)
Google Safe Browsing API

Correct answer: FIDO Alliance Metadata Service (MDS)

The FIDO Alliance Metadata Service (MDS) provides authenticator metadata including attestation certificates and security status, enabling relying parties to validate attestations.

Question 57: Which event should trigger an update to the 'last_used_at' timestamp column in a FIDO2 credential record?

Successful authentication assertion verification (Correct answer)
Any failed authentication attempt
Successful registration only
Scheduled nightly maintenance job

Correct answer: Successful authentication assertion verification

Updating last_used_at on successful assertion confirms the credential is still in active use and supports policies like revoking dormant credentials.

Question 58: Which FIDO2 extension allows a relying party to request a cryptographic proof that the credential is stored in secure hardware?

uvm extension
appid extension
hmac-secret extension
credProtect extension (Correct answer)

Correct answer: credProtect extension

The credProtect extension sets credential protection policies, while device-bound attestation provides hardware storage proof; the uvm extension reports user verification methods used.

Question 59: In a FIDO2 server implementation, what HTTP response should be returned if the client-side origin does not match the registered rpId?

200 OK with an error message in the body
400 Bad Request indicating an origin mismatch (Correct answer)
403 Forbidden
401 Unauthorized

Correct answer: 400 Bad Request indicating an origin mismatch

An origin mismatch indicates a potential attack or misconfiguration; the server should return 400 Bad Request since the request itself is malformed relative to the expected registration.

Question 60: A FIDO2 database schema must enforce that the combination of (rpId, credential_id) is unique. What type of constraint achieves this?

COMPOSITE UNIQUE constraint (Correct answer)
DEFAULT constraint
CHECK constraint
FOREIGN KEY constraint

Correct answer: COMPOSITE UNIQUE constraint

A composite unique constraint on (rpId, credential_id) ensures no two credentials share the same ID under the same relying party.

Question 61: What role does the private key play in FIDO authentication?

It is transmitted to the server for validation
It is used to encrypt data in transit
It is stored securely on the device (Correct answer)
It replaces the need for a public key

Correct answer: It is stored securely on the device

In FIDO authentication, the private key is generated and stored securely on the user's authenticator device, such as a smartphone's secure enclave or a hardware security key. It never leaves the device and is used to cryptographically sign authentication challenges. This ensures that the user's identity is proven without the private key ever being exposed to the server or potential attackers.

Question 62: In FIDO UAF (the predecessor protocol), what term describes a transaction that requires the user to explicitly confirm a specific action using their authenticator?

Ambient authentication
Transaction confirmation (Correct answer)
Passive assertion
Silent authentication

Correct answer: Transaction confirmation

UAF transaction confirmation presents a human-readable transaction description to the user, who must actively confirm it with their authenticator, binding the authentication to the specific action.

Question 63: Why is FIDO authentication considered user-friendly?

It eliminates password fatigue (Correct answer)
It increases reliance on knowledge-based authentication
It requires multiple password entries
It only works on corporate networks

Correct answer: It eliminates password fatigue

FIDO authentication is considered user-friendly because it eliminates password fatigue, which stems from the need to remember complex passwords, change them frequently, and manage multiple credentials. By enabling passwordless logins using familiar gestures like biometrics or PINs, FIDO offers a much simpler, faster, and more intuitive user experience. This convenience encourages stronger security adoption.

Question 64: How does FIDO authentication enhance user privacy?

It requires user information to be stored centrally
It does not store biometric data on central servers (Correct answer)
It relies on email-based authentication links
It uses passwords for identity verification

Correct answer: It does not store biometric data on central servers

FIDO authentication enhances user privacy by not storing biometric data or private keys on central servers. Instead, biometric information (like fingerprints) is processed and verified locally on the user's device. This decentralized approach significantly reduces the risk of large-scale data breaches involving sensitive personal information, as only public keys are shared with online services.

Question 65: What is the DRY principle in programming?

Debug and Run Yearly
Dont Repeat Yourself — avoid code duplication (Correct answer)
Document, Review, Yield
Delete Redundant Yields

Correct answer: Dont Repeat Yourself — avoid code duplication

DRY means every piece of knowledge should have a single, unambiguous representation in a system, reducing redundancy.

Question 66: What is encryption?

Converting data into a coded format that can only be read with the correct key (Correct answer)
Compressing files to save storage space
Backing up data to a remote server
Deleting sensitive data permanently

Correct answer: Converting data into a coded format that can only be read with the correct key

Encryption transforms readable data into an unreadable format, protecting it from unauthorized access even if intercepted.

Question 67: Which component is essential in FIDO authentication?

Shared user credentials
Centralized password storage
CAPTCHA validation
FIDO authenticator (Correct answer)

Correct answer: FIDO authenticator

The FIDO authenticator is an essential component in FIDO authentication. This is the device or software that performs the cryptographic operations and verifies the user's identity locally. It can be a built-in biometric sensor (like a fingerprint reader), a hardware security key, or a software authenticator on a mobile device, holding the user's private key securely.

Question 68: What FIDO concept ensures that a credential registered on example.com cannot be used to authenticate on attacker.com?

Rate limiting on authentication attempts
Certificate transparency logging
User presence check
Cryptographic origin binding via the relying party ID (Correct answer)

Correct answer: Cryptographic origin binding via the relying party ID

Credentials are cryptographically bound to the relying party ID (rpId), which maps to a specific origin, making cross-site credential use cryptographically impossible.

Question 69: What is the purpose of unit testing?

To verify that individual components of code work correctly in isolation (Correct answer)
To test the entire application at once
To check network connectivity
To measure code performance only

Correct answer: To verify that individual components of code work correctly in isolation

Unit tests verify individual components in isolation, catching bugs early and making code more maintainable.

Question 70: Which security measure protects private keys in FIDO authentication?

Manual user entry
Server-side key storage
Cloud-based key distribution
Secure hardware storage (Correct answer)

Correct answer: Secure hardware storage

FIDO private keys are protected by secure hardware storage, such as a Trusted Platform Module (TPM), Secure Enclave, or a dedicated hardware security key. This ensures that the private key is generated, stored, and used in an isolated environment, making it extremely difficult for malware or attackers to extract or compromise it. This hardware-backed security is a cornerstone of FIDO's robust protection.

Question 71: Why is public-key cryptography essential for passwordless authentication?

It requires additional authentication factors
It removes password dependency (Correct answer)
It simplifies password management
It increases reliance on shared secrets

Correct answer: It removes password dependency

Public-key cryptography is essential for passwordless authentication because it allows users to prove their identity without relying on shared secrets like passwords. Instead, the user's device uses its private key to sign a challenge, which the server verifies with the public key. This completely removes the need for passwords and their associated vulnerabilities, offering a more secure and convenient login experience.

Question 72: A FIDO2 server needs to store backup-eligible credential metadata. Which WebAuthn authenticator flag indicates a credential can be backed up?

UV (User Verification)
BE (Backup Eligibility) (Correct answer)
AT (Attested Credential Data)
UP (User Presence)

Correct answer: BE (Backup Eligibility)

The BE flag in the authenticator data indicates the credential is eligible for cloud backup, which the RP should persist to enforce backup-aware policies.

Question 73: What is the purpose of the 'timeout' parameter in a FIDO2 PublicKeyCredentialRequestOptions object?

To define the maximum session length after successful authentication
To specify how long the browser should wait for user interaction before aborting the authentication ceremony (Correct answer)
To rate-limit authentication attempts per minute
To set when the credential expires permanently

Correct answer: To specify how long the browser should wait for user interaction before aborting the authentication ceremony

The timeout parameter tells the browser how many milliseconds to wait for the user to interact with their authenticator before the ceremony is aborted, improving UX without leaving open-ended prompts.

Question 74: How does FCP certification benefit employers?

It reduces salary requirements
It provides assurance of employee competence and commitment to professional standards (Correct answer)
It guarantees perfect job performance
It eliminates the need for on-the-job training

Correct answer: It provides assurance of employee competence and commitment to professional standards

Certified employees have demonstrated verified knowledge and dedication to their profession, reducing risk for employers.

Question 75: Which transport indicator should a server include when registering a USB security key to indicate the communication channel?

transport: 'nfc'
transport: 'usb' (Correct answer)
transport: 'internal'
transport: 'ble'

Correct answer: transport: 'usb'

The 'usb' transport indicator specifies that the authenticator communicates via USB, helping the client filter appropriate authenticators during future authentication.

Question 76: What is the primary purpose of the FCP certification program?

To replace academic degrees
To validate professional competence and knowledge in the field (Correct answer)
To limit the number of professionals
To generate revenue for the certifying organization

Correct answer: To validate professional competence and knowledge in the field

The FCP certification validates that professionals have demonstrated the knowledge and skills required for competent practice.

Question 77: In FIDO2 database design, storing the 'transports' array alongside a credential is useful because:

It allows the RP to suggest the correct authenticator during future authentication (Correct answer)
It records network latency during registration
It enforces that only USB tokens can authenticate
It encrypts the credential on transport

Correct answer: It allows the RP to suggest the correct authenticator during future authentication

Persisting the transports hint lets the RP call getAllowCredentials with transport hints, improving UX by directing the browser to the right authenticator.

Question 78: Which authentication method is primarily used in FIDO protocols?

Shared secret keys
Symmetric encryption
Public-key cryptography (Correct answer)
Biometric templates stored on a server

Correct answer: Public-key cryptography

FIDO protocols primarily use public-key cryptography for strong, phishing-resistant authentication. This method involves a pair of cryptographically linked keys: a private key stored securely on the user's device and a public key registered with the online service. When authenticating, the device uses the private key to sign a challenge from the service, verifying the user's identity without transmitting sensitive credentials.

Question 79: What is the difference between compiled and interpreted languages?

Compiled languages are always faster
Compiled code is translated to machine code before execution; interpreted code is translated line by line during execution (Correct answer)
Interpreted languages cannot be used for web development
There is no practical difference

Correct answer: Compiled code is translated to machine code before execution; interpreted code is translated line by line during execution

Compiled languages are fully translated before execution, while interpreted languages are translated during runtime.

Question 80: How does the public key in FIDO authentication improve security?

It replaces biometric authentication
It generates one-time passwords
It encrypts user passwords
It verifies authentication requests (Correct answer)

Correct answer: It verifies authentication requests

The public key in FIDO authentication is registered with the online service and is used to verify the cryptographic signature generated by the user's private key during an authentication request. This verification process confirms that the request originated from the legitimate user's device without requiring the server to ever know the private key. This separation of keys significantly enhances security by preventing credential compromise even if the server is breached.

Question 81: When implementing passkeys with cross-device authentication, which protocol enables the phone to communicate with the desktop browser?

Bluetooth Low Energy (BLE) via CTAP2 hybrid transport (Correct answer)
QR code only over TLS
Direct Wi-Fi peer-to-peer
NFC tap-to-authenticate

Correct answer: Bluetooth Low Energy (BLE) via CTAP2 hybrid transport

CTAP2 hybrid transport uses BLE for proximity detection and a QR code to bootstrap a secure channel, enabling cross-device authentication for passkeys.

Question 82: What is the CIA triad in information security?

Compliance, Insurance, and Auditing
Cryptography, Identity, and Authentication
Confidentiality, Integrity, and Availability (Correct answer)
Control, Investigation, and Authorization

Correct answer: Confidentiality, Integrity, and Availability

The CIA triad represents the three fundamental objectives of information security: keeping data confidential, maintaining its integrity, and ensuring its availability.

Question 83: Which WebAuthn concept defines the database-level scope within which credential_ids must be unique?

Origin
AAGUID namespace
Relying Party ID (rpId) (Correct answer)
User Handle

Correct answer: Relying Party ID (rpId)

The rpId scopes credentials, so uniqueness of credential_id is enforced per rpId, not globally across all relying parties.

Question 84: Which protocol is the foundation of FIDO authentication?

Kerberos
SAML
OAuth 2.0
FIDO UAF (Correct answer)

Correct answer: FIDO UAF

FIDO UAF (Universal Authentication Framework) was one of the original FIDO specifications, designed to enable passwordless authentication using various on-device authenticators like biometrics or PINs. It laid the groundwork for secure, multi-factor authentication directly from a user's device, eliminating the need for traditional passwords. This protocol established the core principles of FIDO's approach to strong, user-friendly authentication.

Question 85: What is the primary benefit of public-key cryptography in FIDO authentication?

It uses passwords for authentication
It eliminates shared secrets (Correct answer)
It relies on symmetric encryption
It requires centralized key management

Correct answer: It eliminates shared secrets

Public-key cryptography in FIDO eliminates the need for shared secrets, such as passwords, between the user and the service provider. Instead, the user's device proves identity by signing a challenge with its private key, which the service verifies using the publicly registered key. This design prevents credential theft from server breaches and phishing attacks, as no secret is ever transmitted or stored on the server.

Question 86: What is the purpose of code review?

To slow down the development process
To satisfy management reporting requirements only
To assign blame for errors
To identify bugs, improve code quality, and share knowledge among team members (Correct answer)

Correct answer: To identify bugs, improve code quality, and share knowledge among team members

Code review improves quality through peer examination, catches defects early, and spreads knowledge across the team.

Question 87: What is the function of the 'allowCredentials' list sent by a relying party during a FIDO2 authentication request?

To enumerate all registered users on the platform
To specify which credentials the server will accept for a given user, reducing discovery scope (Correct answer)
To list users allowed to log in to the site
To set the minimum security level for authenticators

Correct answer: To specify which credentials the server will accept for a given user, reducing discovery scope

The allowCredentials list tells the authenticator which credential IDs are acceptable for the given user, enabling the authenticator to select the correct key without exposing other users' credentials.

Question 88: A FIDO2 relying party experiences a database breach. Which stored credential field poses the greatest risk if exposed to an attacker?

user_handle
credential_id (Correct answer)
aaguid
Public key

Correct answer: credential_id

The credential_id, combined with the RP's allowCredentials list, can be used in targeted phishing; however, the public key alone cannot be used to authenticate without the private key on the authenticator.

Question 89: Which data structure operates on a Last-In-First-Out (LIFO) principle?

Queue
Linked List
Hash Table
Stack (Correct answer)

Correct answer: Stack

A stack follows LIFO ordering — the most recently added element is the first to be removed.

Question 90: What is the main feature of FIDO2?

It enables passwordless authentication (Correct answer)
It relies solely on SMS authentication
It enhances traditional password security
It is limited to biometric authentication only

Correct answer: It enables passwordless authentication

FIDO2 is the latest generation of FIDO specifications, building upon its predecessors to enable robust passwordless authentication experiences across various platforms and devices. By integrating with web browsers and operating systems via WebAuthn, FIDO2 allows users to log in securely using biometrics, PINs, or external security keys without ever typing a password. This eliminates the vulnerabilities associated with passwords and improves user convenience.

FIDO Certified Professional (FCP)

The FIDO Certified Professional (FCP) certification validates expertise in designing, implementing, and deploying FIDO authentication solutions, covering business requirements analysis, technical implementation, and FIDO protocol standards.

Questions

160 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

pearsonvue.com — Test delivery, eligibility, fees, renewal, retake fee, retake policy, score release, score validity, exam information · verified Nov 2026