FCP Programming Fundamentals 3 — Questions and Answers
Question 1: Which WebAuthn API method is called on the client side to begin a FIDO2 authentication (assertion) ceremony?
- navigator.credentials.verify()
- navigator.credentials.get() (Correct answer)
- navigator.credentials.login()
- navigator.credentials.assert()
Correct answer: navigator.credentials.get()
`navigator.credentials.get()` with a `publicKey` option triggers the authentication ceremony and returns an AuthenticatorAssertionResponse.
Question 2: What is the role of the `allowCredentials` array in a WebAuthn authentication request?
- It lists all public keys stored on the FIDO server
- It tells the authenticator which credential IDs are acceptable for this user (Correct answer)
- It defines the set of allowed cryptographic algorithms
- It specifies the maximum session timeout in seconds
Correct answer: It tells the authenticator which credential IDs are acceptable for this user
The relying party populates `allowCredentials` with the user's registered credential IDs so the authenticator knows which key to use.
Question 3: Within the `authenticatorData` flags byte, which bit indicates that the user was physically present during the operation?
- The UV (User Verification) bit
- The UP (User Presence) bit (Correct answer)
- The AT (Attested Credential Data) bit
- The ED (Extension Data) bit
Correct answer: The UP (User Presence) bit
Bit 0 of the flags byte is the User Presence (UP) bit; relying parties must verify it is set for every authentication response.
Question 4: Why do FIDO2 authenticators maintain a signature counter that increments on each authentication?
- To count consecutive failed PIN attempts before lockout
- To allow relying parties to detect potentially cloned authenticators (Correct answer)
- To measure the latency of cryptographic operations
- To track how many credentials are registered on the device
Correct answer: To allow relying parties to detect potentially cloned authenticators
If an authenticator is cloned, both copies share the same counter; a server seeing an equal or lower counter value on an assertion is a signal of possible cloning.
Question 5: During WebAuthn registration, where is the newly generated credential public key embedded?
- In the AuthenticatorAssertionResponse body
- In the authenticatorData section of the AuthenticatorAttestationResponse (Correct answer)
- In the clientDataJSON field
- In the rp.id field of the request options
Correct answer: In the authenticatorData section of the AuthenticatorAttestationResponse
The credential public key is CBOR-encoded inside the `attestedCredentialData` portion of `authenticatorData`, which is part of the `AuthenticatorAttestationResponse`.
Question 6: After parsing `clientDataJSON`, what must the relying party verify about the `origin` field?
- It must be a valid HTTPS URL with no path component
- It must exactly match the relying party's expected origin (Correct answer)
- It must contain the authenticated user's IP address
- It must be encoded as UTF-16 big-endian
Correct answer: It must exactly match the relying party's expected origin
The server compares the origin in `clientDataJSON` against its own expected origin to prevent cross-origin credential misuse.
Question 7: Setting `userVerification` to `'required'` in WebAuthn options enforces which behavior?
- The server must send a verification email before accepting the response
- The authenticator must perform local user verification (PIN or biometric) before signing (Correct answer)
- The credential must use a key size of RSA-2048 or larger
- The RP must store a copy of the user's biometric template
Correct answer: The authenticator must perform local user verification (PIN or biometric) before signing
When set to 'required', the authenticator must locally verify the user (via PIN, fingerprint, etc.) and set the UV bit in authenticatorData before the relying party accepts the response.
FCP Programming Fundamentals 3
Which WebAuthn API method is called on the client side to begin a FIDO2 authentication (assertion) ceremony?