FCP Database Management 4

Question 1

A FIDO2 relying party receives a credential with sign_count=0 during authentication, while the stored sign_count is also 0. Per the WebAuthn spec, the RP should:

Accepted Answer

Accept authentication but note the authenticator may not implement counters

Answer

A sign_count of 0 from both sides indicates the authenticator does not implement counters; the spec permits acceptance with a logged warning.

Question 2

Which cryptographic algorithm identifier should the FIDO2 credential database store alongside the public key to correctly verify future assertions?

Accepted Answer

COSE algorithm identifier (e.g., -7 for ES256)

Answer

The COSE algorithm identifier specifies how the public key must be used for verification, and it must be persisted with the credential record.

Question 3

In FIDO2 database design, storing the 'transports' array alongside a credential is useful because:

Accepted Answer

It allows the RP to suggest the correct authenticator during future authentication

Answer

Persisting the transports hint lets the RP call getAllowCredentials with transport hints, improving UX by directing the browser to the right authenticator.

Question 4

A FIDO2 RP database needs to prevent two concurrent registrations from inserting the same credential_id. Which mechanism is most reliable?

Accepted Answer

UNIQUE database constraint on credential_id with transaction rollback on conflict

Answer

A database-enforced UNIQUE constraint guarantees atomicity at the storage layer, eliminating race conditions that application locks cannot fully prevent.

Question 5

Which event should trigger an update to the 'last_used_at' timestamp column in a FIDO2 credential record?

Accepted Answer

Successful authentication assertion verification

Answer

Updating last_used_at on successful assertion confirms the credential is still in active use and supports policies like revoking dormant credentials.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Database Management 4