FCP Network Fundamentals 3 — Questions and Answers
Question 1: How does FIDO2 protect against network-based replay attacks during authentication?
- The server issues a random challenge per ceremony; the authenticator signs it so each response is unique (Correct answer)
- TLS session tickets prevent replay at the transport layer
- The credential ID rotates on each authentication
- The relying party uses IP geolocation to detect replays
Correct answer: The server issues a random challenge per ceremony; the authenticator signs it so each response is unique
A fresh random challenge per authentication ceremony ensures that captured authenticator responses cannot be replayed on the network.
Question 2: What does the 'origin' field in WebAuthn clientDataJSON represent at the network level?
- The scheme, host, and port of the page that initiated the WebAuthn call (Correct answer)
- The IP address of the relying party server
- The DNS server that resolved the relying party domain
- The MAC address of the client device
Correct answer: The scheme, host, and port of the page that initiated the WebAuthn call
The origin is the full scheme+host+port tuple (e.g., https://example.com:443) from which the WebAuthn API was called.
Question 3: Which FIDO2 transport allows an authenticator on a mobile phone to authenticate a desktop browser session over a local network?
- caBLE (Cloud-Assisted Bluetooth Low Energy) / hybrid transport (Correct answer)
- USB tethering
- NFC relay
- Wi-Fi Direct
Correct answer: caBLE (Cloud-Assisted Bluetooth Low Energy) / hybrid transport
The caBLE/hybrid transport uses BLE for proximity verification and a cloud relay to bridge the authenticator phone with the desktop browser.
Question 4: In FIDO UAF, what network mechanism prevents a phishing site from successfully proxying an authentication ceremony?
- The facet ID (app ID) is bound to the authenticated origin, and a spoofed origin fails facet validation (Correct answer)
- DNSSEC prevents DNS spoofing of the facet URL
- The server checks the client IP against the registered device IP
- Rate limiting on the authentication endpoint blocks proxies
Correct answer: The facet ID (app ID) is bound to the authenticated origin, and a spoofed origin fails facet validation
UAF facet IDs bind the authentication to a specific app or origin; a phishing proxy presents a different facet and the authenticator refuses to sign.
Question 5: What is the maximum recommended size of the FIDO2 authenticatorData structure to avoid IP fragmentation on typical networks?
- FIDO2 does not impose a size limit tied to IP fragmentation; the authenticatorData is transported over TLS which handles fragmentation (Correct answer)
- 512 bytes to fit within a single UDP datagram
- 1400 bytes to stay under typical Ethernet MTU after TLS overhead
- 64 bytes to fit in a USB HID report
Correct answer: FIDO2 does not impose a size limit tied to IP fragmentation; the authenticatorData is transported over TLS which handles fragmentation
FIDO2 over HTTPS/TLS inherits TCP's handling of fragmentation, so there is no FIDO-specific size limit tied to IP MTU.
Question 6: Which field in the WebAuthn PublicKeyCredentialRequestOptions helps prevent cross-origin credential use over the network?
- rpId — the relying party identifier that must match the request origin (Correct answer)
- challenge — the random nonce preventing replay
- allowCredentials — listing permitted credential IDs
- timeout — limiting the authentication window
Correct answer: rpId — the relying party identifier that must match the request origin
The rpId must be a registrable domain suffix of the origin, preventing a credential registered on one domain from being used on another.
Question 7: During a FIDO2 registration over a corporate Wi-Fi network with captive portal, what condition must be met before registration can succeed?
- The captive portal must be fully authenticated so the browser has an unrestricted HTTPS connection to the relying party (Correct answer)
- The authenticator must be on the same Wi-Fi SSID as the server
- The RADIUS server must whitelist the authenticator MAC address
- NFC must be disabled on the network to prevent interference
Correct answer: The captive portal must be fully authenticated so the browser has an unrestricted HTTPS connection to the relying party
WebAuthn requires a secure context (HTTPS); a captive portal that intercepts traffic prevents establishing the TLS connection needed for registration.
FCP Network Fundamentals 3
How does FIDO2 protect against network-based replay attacks during authentication?