FCP Programming Fundamentals 2 — Questions and Answers
Question 1: Which JavaScript method on the `navigator.credentials` object initiates a FIDO2 credential registration ceremony?
- navigator.credentials.register()
- navigator.credentials.create() (Correct answer)
- navigator.credentials.enroll()
- navigator.credentials.authenticate()
Correct answer: navigator.credentials.create()
The WebAuthn API exposes `navigator.credentials.create()` to create a new public key credential during registration.
Question 2: What is the primary purpose of the `challenge` field provided by the relying party during WebAuthn registration?
- To identify the user's account on the server
- To prevent replay attacks by ensuring each ceremony is unique (Correct answer)
- To specify the supported cryptographic algorithms
- To encode the user's public key before transmission
Correct answer: To prevent replay attacks by ensuring each ceremony is unique
The challenge is a server-generated random value that the authenticator signs, ensuring the response cannot be replayed.
Question 3: Binary data exchanged with the WebAuthn browser API (e.g., challenge, credential ID) must be encoded in which format?
- Base64url (Correct answer)
- Hexadecimal string
- UTF-8 plain text
- Standard Base64
Correct answer: Base64url
WebAuthn uses Base64url encoding (URL-safe, no padding) for all ArrayBuffer values exchanged between the client and server.
Question 4: What does the Promise returned by `navigator.credentials.create()` resolve to on success?
- A JSON Web Token (JWT) containing user claims
- A PublicKeyCredential object (Correct answer)
- A DOMString containing the credential ID
- A SAML 2.0 assertion
Correct answer: A PublicKeyCredential object
`navigator.credentials.create()` resolves to a `PublicKeyCredential` object containing the attestation response and credential metadata.
Question 5: In a WebAuthn registration call, what value should `publicKeyCredentialCreationOptions.rp.id` typically be set to?
- The user's email address
- The effective domain of the relying party (Correct answer)
- A randomly generated GUID for the session
- The IP address of the origin server
Correct answer: The effective domain of the relying party
The RP ID must be set to the effective domain (e.g., 'example.com') so the authenticator can bind the credential to that origin.
Question 6: Which COSE algorithm identifier value represents ECDSA with SHA-256 (ES256) in WebAuthn?
- -257 (RS256)
- -7 (ES256) (Correct answer)
- -37 (PS256)
- -8 (EdDSA)
Correct answer: -7 (ES256)
COSE algorithm ID -7 designates ES256 (ECDSA with P-256 curve and SHA-256), the most widely supported WebAuthn algorithm.
Question 7: What two key pieces of data does the authenticator return inside the attestation object during FIDO2 registration?
- The user's password hash and session cookie
- The new credential's public key and an attestation statement (Correct answer)
- A server-issued JWT and a nonce
- The RP's TLS certificate and a HMAC
Correct answer: The new credential's public key and an attestation statement
The attestation object contains authenticatorData (which embeds the new public key) and an attestation statement that vouches for the authenticator's authenticity.
FCP Programming Fundamentals 2
Which JavaScript method on the `navigator.credentials` object initiates a FIDO2 credential registration ceremony?