FCP Network Fundamentals 3

Question 1

How does FIDO2 protect against network-based replay attacks during authentication?

Accepted Answer

The server issues a random challenge per ceremony; the authenticator signs it so each response is unique

Answer

A fresh random challenge per authentication ceremony ensures that captured authenticator responses cannot be replayed on the network.

Question 2

What does the 'origin' field in WebAuthn clientDataJSON represent at the network level?

Accepted Answer

The scheme, host, and port of the page that initiated the WebAuthn call

Answer

The origin is the full scheme+host+port tuple (e.g., https://example.com:443) from which the WebAuthn API was called.

Question 3

Which FIDO2 transport allows an authenticator on a mobile phone to authenticate a desktop browser session over a local network?

Accepted Answer

caBLE (Cloud-Assisted Bluetooth Low Energy) / hybrid transport

Answer

The caBLE/hybrid transport uses BLE for proximity verification and a cloud relay to bridge the authenticator phone with the desktop browser.

Question 4

In FIDO UAF, what network mechanism prevents a phishing site from successfully proxying an authentication ceremony?

Accepted Answer

The facet ID (app ID) is bound to the authenticated origin, and a spoofed origin fails facet validation

Answer

UAF facet IDs bind the authentication to a specific app or origin; a phishing proxy presents a different facet and the authenticator refuses to sign.

Question 5

What is the maximum recommended size of the FIDO2 authenticatorData structure to avoid IP fragmentation on typical networks?

Accepted Answer

FIDO2 does not impose a size limit tied to IP fragmentation; the authenticatorData is transported over TLS which handles fragmentation

Answer

FIDO2 over HTTPS/TLS inherits TCP's handling of fragmentation, so there is no FIDO-specific size limit tied to IP MTU.

(FCP) FIDO Certified Professional Practice Test