FCP FIDO Attestation and Metadata

Question 1

What is the primary purpose of attestation in FIDO2/WebAuthn?

Accepted Answer

To prove the authenticity and integrity of an authenticator to a relying party

Answer

Attestation allows a relying party to cryptographically verify that the authenticator is genuine and was manufactured by a trusted vendor.

Question 2

Which of the following is NOT a standard attestation statement format defined in WebAuthn?

Accepted Answer

OAuth attestation

Answer

WebAuthn defines packed, TPM, Android Key, Android SafetyNet, FIDO U2F, and none formats — OAuth is an authorization protocol, not a WebAuthn attestation format.

Question 3

What does the FIDO Metadata Service (MDS) primarily provide to relying parties?

Accepted Answer

Metadata statements describing authenticator properties, certifications, and trust anchors

Answer

The FIDO MDS provides metadata statements that describe authenticator capabilities, certification level, and the root certificates needed to verify attestation signatures.

Question 4

What is a WebAuthn attestation statement?

Accepted Answer

A data structure signed by the authenticator proving its identity and the binding of the new credential

Answer

An attestation statement is produced by the authenticator during credential creation and contains a signature over the authenticator data, proving the credential's origin.

Question 5

What does 'none' attestation convey in WebAuthn?

Accepted Answer

No attestation information is provided, making it impossible to verify the authenticator's origin

Answer

The 'none' attestation format means the authenticator provides no statement about its provenance, so the relying party cannot determine what kind of authenticator was used.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP FIDO Attestation and Metadata