FCP Network Fundamentals 2 — Questions and Answers
Question 1: Which transport layer protocol does FIDO2 WebAuthn rely on to ensure confidentiality between client and server?
- TLS 1.2 or higher (Correct answer)
- IPsec tunnel mode
- DTLS over UDP
- SSH port forwarding
Correct answer: TLS 1.2 or higher
WebAuthn requires TLS 1.2 or higher to protect the channel over which authenticator assertions are transmitted.
Question 2: What role does DNS play in the FIDO2 authentication flow?
- It resolves the relying party ID to verify the origin domain matches the RP ID (Correct answer)
- It provides IP address lookup for the authenticator hardware
- It routes CTAP messages between the client and authenticator
- It validates the server's FIDO metadata
Correct answer: It resolves the relying party ID to verify the origin domain matches the RP ID
DNS resolution of the origin domain is implicitly used by the browser to verify the RP ID is a registrable domain suffix of the origin.
Question 3: When a FIDO client communicates with a roaming authenticator over Bluetooth Low Energy, which network topology is used?
- Point-to-point piconet (Correct answer)
- Star topology via Bluetooth coordinator
- Mesh network via BLE relay nodes
- Bus topology with shared GATT server
Correct answer: Point-to-point piconet
BLE uses a point-to-point piconet where one device acts as central (the client platform) and the other as peripheral (the authenticator).
Question 4: Which port is standardly used for FIDO MDS3 (Metadata Service) HTTPS fetch operations?
- 443 (Correct answer)
- 8080
- 3000
- 8443
Correct answer: 443
FIDO MDS3 metadata is fetched over standard HTTPS on port 443.
Question 5: In a corporate network, a proxy server intercepts TLS traffic. What impact does TLS inspection have on FIDO2 authentication?
- It breaks origin binding because the browser sees the proxy certificate, not the server's (Correct answer)
- It has no impact as FIDO2 operates below TLS
- It allows the proxy to forge authenticator assertions
- It only affects U2F, not FIDO2
Correct answer: It breaks origin binding because the browser sees the proxy certificate, not the server's
TLS inspection (man-in-the-middle proxy) changes the origin seen by the browser, which can break WebAuthn's relying party origin validation.
Question 6: What is the purpose of the clientDataHash in FIDO2's network-level security model?
- It cryptographically binds the authenticator response to the specific challenge and origin sent over the network (Correct answer)
- It encrypts the credential ID during network transport
- It authenticates the TLS certificate of the relying party server
- It provides a MAC over the BLE channel data
Correct answer: It cryptographically binds the authenticator response to the specific challenge and origin sent over the network
The clientDataHash is a SHA-256 hash of clientDataJSON containing the challenge and origin, ensuring the authenticator's signature covers network-level context.
Question 7: Which network protocol is used by CTAP2 when a FIDO2 authenticator connects via USB HID?
- USB HID is a local bus protocol, not a network protocol — no IP layer is involved (Correct answer)
- TCP/IP over USB RNDIS
- USB CDC-ACM serial over IP
- HTTP/2 over USB tunneling
Correct answer: USB HID is a local bus protocol, not a network protocol — no IP layer is involved
USB HID is a direct local bus interface; CTAP2 over USB HID does not involve any IP networking layer.
FCP Network Fundamentals 2
Which transport layer protocol does FIDO2 WebAuthn rely on to ensure confidentiality between client and server?