FCP Database Management 3 — Questions and Answers
Question 1: A relying party's credential database stores the 'aaguid'. What is the primary purpose of persisting this value?
- To encrypt the credential's private key
- To identify the authenticator model for policy enforcement and display (Correct answer)
- To track the number of failed authentication attempts
- To store the user's preferred language
Correct answer: To identify the authenticator model for policy enforcement and display
The AAGUID (Authenticator Attestation GUID) identifies the authenticator model, enabling RPs to enforce policies like requiring FIPS-certified devices.
Question 2: Which database isolation level is recommended when reading and updating the sign_count during FIDO2 authentication to prevent phantom reads?
- READ UNCOMMITTED
- READ COMMITTED
- REPEATABLE READ
- SERIALIZABLE (Correct answer)
Correct answer: SERIALIZABLE
SERIALIZABLE isolation prevents concurrent transactions from reading stale sign_count values that could allow a replay attack to succeed.
Question 3: In a multi-tenant FIDO2 platform, why must each tenant's credentials be logically isolated at the database level?
- To reduce backup storage costs
- To prevent one tenant's credential_ids from conflicting with or leaking to another tenant (Correct answer)
- To allow credential sharing between tenants for SSO
- To comply with WebAuthn's mandatory sharding requirement
Correct answer: To prevent one tenant's credential_ids from conflicting with or leaking to another tenant
Without logical isolation, credential lookups could cross tenant boundaries, creating both data leakage and potential authentication bypass risks.
Question 4: What is the recommended maximum byte length for a FIDO2 credential_id that a relying party database column should accommodate?
- 64 bytes
- 128 bytes
- 1023 bytes (Correct answer)
- 4096 bytes
Correct answer: 1023 bytes
The WebAuthn specification states credential IDs can be up to 1023 bytes, so the column must accommodate at least that length.
Question 5: A FIDO2 relying party wants to support multiple credentials per user. How should the database schema represent this relationship?
- Store all credential_ids in a JSON array in the users table
- Create a separate credentials table with a foreign key referencing the users table (Correct answer)
- Add numbered columns (credential_1, credential_2, ...) to the users table
- Encode all credentials in a single Base64 string per user
Correct answer: Create a separate credentials table with a foreign key referencing the users table
A separate credentials table with a user foreign key is the normalized approach that scales cleanly and supports efficient per-user credential queries.
Question 6: When a FIDO2 authenticator is reported lost, what database operation should the relying party perform on that credential record?
- Delete the record permanently and issue a new credential_id
- Set a revoked flag or status and record the revocation timestamp (Correct answer)
- Update the sign_count to zero to invalidate future assertions
- Move the record to a public log table for transparency
Correct answer: Set a revoked flag or status and record the revocation timestamp
Marking the credential as revoked with a timestamp preserves the audit trail while immediately preventing its use for authentication.
Question 7: Which stored credential field is compared byte-for-byte during the WebAuthn assertion verification process?
- user_display_name
- stored public key (Correct answer)
- aaguid
- rp_name
Correct answer: stored public key
The stored public key is used to verify the cryptographic signature in the authenticator's assertion response, requiring exact byte-level comparison.
FCP Database Management 3
A relying party's credential database stores the 'aaguid'.
What is the primary purpose of persisting this value?