FCP Database Management 5

Question 1

A FIDO2 relying party experiences a database breach. Which stored credential field poses the greatest risk if exposed to an attacker?

Accepted Answer

credential_id

Answer

The credential_id, combined with the RP's allowCredentials list, can be used in targeted phishing; however, the public key alone cannot be used to authenticate without the private key on the authenticator.

Question 2

How should a FIDO2 relying party handle a situation where the received sign_count is less than the stored sign_count?

Accepted Answer

Reject authentication and flag the credential as potentially cloned

Answer

A decreasing sign_count is a strong indicator of a cloned authenticator; the spec requires the RP to reject the assertion and may revoke the credential.

Question 3

In a high-availability FIDO2 deployment with read replicas, what risk arises when authentication reads the sign_count from a replica?

Accepted Answer

Replication lag may cause a stale sign_count to be used, allowing replay attacks

Answer

Replication lag means replicas may have outdated sign_count values, so authentication reads must always target the primary (master) database node.

Question 4

Which WebAuthn concept defines the database-level scope within which credential_ids must be unique?

Accepted Answer

Relying Party ID (rpId)

Answer

The rpId scopes credentials, so uniqueness of credential_id is enforced per rpId, not globally across all relying parties.

Question 5

A FIDO2 credential database schema includes an 'attestation_object' column. Why might the RP choose to persist this binary blob?

Accepted Answer

To re-verify attestation at a later time or to support audits requiring proof of authenticator authenticity

Answer

Persisting the attestation object allows the RP to re-verify the authenticator's certification status if trust anchors are updated after initial registration.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Database Management 5