FCP Programming Fundamentals 3

Question 1

Which WebAuthn API method is called on the client side to begin a FIDO2 authentication (assertion) ceremony?

Accepted Answer

navigator.credentials.get()

Answer

`navigator.credentials.get()` with a `publicKey` option triggers the authentication ceremony and returns an AuthenticatorAssertionResponse.

Question 2

What is the role of the `allowCredentials` array in a WebAuthn authentication request?

Accepted Answer

It tells the authenticator which credential IDs are acceptable for this user

Answer

The relying party populates `allowCredentials` with the user's registered credential IDs so the authenticator knows which key to use.

Question 3

Within the `authenticatorData` flags byte, which bit indicates that the user was physically present during the operation?

Accepted Answer

The UP (User Presence) bit

Answer

Bit 0 of the flags byte is the User Presence (UP) bit; relying parties must verify it is set for every authentication response.

Question 4

Why do FIDO2 authenticators maintain a signature counter that increments on each authentication?

Accepted Answer

To allow relying parties to detect potentially cloned authenticators

Answer

If an authenticator is cloned, both copies share the same counter; a server seeing an equal or lower counter value on an assertion is a signal of possible cloning.

Question 5

During WebAuthn registration, where is the newly generated credential public key embedded?

Accepted Answer

In the authenticatorData section of the AuthenticatorAttestationResponse

Answer

The credential public key is CBOR-encoded inside the `attestedCredentialData` portion of `authenticatorData`, which is part of the `AuthenticatorAttestationResponse`.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Programming Fundamentals 3