FCP Database Management 3

Question 1

A relying party's credential database stores the 'aaguid'. What is the primary purpose of persisting this value?

Accepted Answer

To identify the authenticator model for policy enforcement and display

Answer

The AAGUID (Authenticator Attestation GUID) identifies the authenticator model, enabling RPs to enforce policies like requiring FIPS-certified devices.

Question 2

Which database isolation level is recommended when reading and updating the sign_count during FIDO2 authentication to prevent phantom reads?

Accepted Answer

SERIALIZABLE

Answer

SERIALIZABLE isolation prevents concurrent transactions from reading stale sign_count values that could allow a replay attack to succeed.

Question 3

In a multi-tenant FIDO2 platform, why must each tenant's credentials be logically isolated at the database level?

Accepted Answer

To prevent one tenant's credential_ids from conflicting with or leaking to another tenant

Answer

Without logical isolation, credential lookups could cross tenant boundaries, creating both data leakage and potential authentication bypass risks.

Question 4

What is the recommended maximum byte length for a FIDO2 credential_id that a relying party database column should accommodate?

Accepted Answer

1023 bytes

Answer

The WebAuthn specification states credential IDs can be up to 1023 bytes, so the column must accommodate at least that length.

Question 5

A FIDO2 relying party wants to support multiple credentials per user. How should the database schema represent this relationship?

Accepted Answer

Create a separate credentials table with a foreign key referencing the users table

Answer

A separate credentials table with a user foreign key is the normalized approach that scales cleanly and supports efficient per-user credential queries.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Database Management 3