FCP Programming Fundamentals 2

Question 1

Which JavaScript method on the `navigator.credentials` object initiates a FIDO2 credential registration ceremony?

Accepted Answer

navigator.credentials.create()

Answer

The WebAuthn API exposes `navigator.credentials.create()` to create a new public key credential during registration.

Question 2

What is the primary purpose of the `challenge` field provided by the relying party during WebAuthn registration?

Accepted Answer

To prevent replay attacks by ensuring each ceremony is unique

Answer

The challenge is a server-generated random value that the authenticator signs, ensuring the response cannot be replayed.

Question 3

Binary data exchanged with the WebAuthn browser API (e.g., challenge, credential ID) must be encoded in which format?

Accepted Answer

Base64url

Answer

WebAuthn uses Base64url encoding (URL-safe, no padding) for all ArrayBuffer values exchanged between the client and server.

Question 4

What does the Promise returned by `navigator.credentials.create()` resolve to on success?

Accepted Answer

A PublicKeyCredential object

Answer

`navigator.credentials.create()` resolves to a `PublicKeyCredential` object containing the attestation response and credential metadata.

Question 5

In a WebAuthn registration call, what value should `publicKeyCredentialCreationOptions.rp.id` typically be set to?

Accepted Answer

The effective domain of the relying party

Answer

The RP ID must be set to the effective domain (e.g., 'example.com') so the authenticator can bind the credential to that origin.

(FCP) FIDO Certified Professional Practice Test