FCP Database Management 2 — Questions and Answers
Question 1: In a FIDO2 relying party database, what is the correct data type to use for storing a credential's public key?
- VARCHAR(255)
- BLOB or BYTEA (binary large object) (Correct answer)
- INTEGER
- TEXT with Base64 encoding only
Correct answer: BLOB or BYTEA (binary large object)
Public keys are binary data and must be stored as a binary large object (BLOB/BYTEA) to preserve byte-exact fidelity.
Question 2: Which field in the FIDO2 credential record uniquely identifies a credential within a specific relying party?
- user_handle
- aaguid
- credential_id (Correct answer)
- rpId
Correct answer: credential_id
The credential_id is the unique identifier assigned by the authenticator that distinguishes each credential at the relying party.
Question 3: A FIDO2 database schema must enforce that the combination of (rpId, credential_id) is unique. What type of constraint achieves this?
- CHECK constraint
- FOREIGN KEY constraint
- COMPOSITE UNIQUE constraint (Correct answer)
- DEFAULT constraint
Correct answer: COMPOSITE UNIQUE constraint
A composite unique constraint on (rpId, credential_id) ensures no two credentials share the same ID under the same relying party.
Question 4: Why must the sign_count value in a FIDO2 credential record be updated atomically with its validation check?
- To reduce database write latency
- To prevent race conditions that could allow replay attacks (Correct answer)
- To comply with GDPR data minimization rules
- To ensure the counter resets on each authentication
Correct answer: To prevent race conditions that could allow replay attacks
Atomic read-validate-write of the sign_count prevents concurrent requests from exploiting a window where a replayed assertion could pass.
Question 5: In a FIDO2 credential store, the 'user_handle' is best described as:
- The user's display name stored as plaintext
- An opaque byte sequence that maps a credential to a user account (Correct answer)
- The SHA-256 hash of the user's email address
- A UUID generated by the authenticator
Correct answer: An opaque byte sequence that maps a credential to a user account
The user_handle is an opaque, server-generated byte sequence that links a credential to a user without exposing PII to the authenticator.
Question 6: Which indexing strategy is most appropriate for a FIDO2 credential table expected to handle millions of authentication lookups per day?
- Full-table scan on every lookup
- B-tree index on credential_id (Correct answer)
- Hash index on user display name
- Clustered index on creation_timestamp
Correct answer: B-tree index on credential_id
A B-tree index on credential_id enables O(log n) lookups, making authentication queries fast at scale.
Question 7: When archiving deactivated FIDO2 credentials, which practice aligns with both security and auditability requirements?
- Hard delete immediately to minimize attack surface
- Soft delete with a deactivated_at timestamp and retain for the audit period (Correct answer)
- Move to a public schema for easier reporting
- Re-use the credential_id for new credentials after deletion
Correct answer: Soft delete with a deactivated_at timestamp and retain for the audit period
Soft deletes preserve audit trails while preventing the credential from being used, satisfying both security and compliance needs.
FCP Database Management 2
In a FIDO2 relying party database, what is the correct data type to use for storing a credential's public key?