FCP Security Principles and Practices 2 — Questions and Answers
Question 1: Which security principle states that a user or process should only have the minimum permissions necessary to perform its function?
- Defense in depth
- Least privilege (Correct answer)
- Zero trust
- Separation of duties
Correct answer: Least privilege
Least privilege limits the access rights for users, accounts, and computing processes to only what is strictly required to perform their intended tasks.
Question 2: In FIDO2, which component is responsible for creating and storing private keys used during authentication?
- Relying party server
- Client application
- Authenticator (Correct answer)
- CTAP transport layer
Correct answer: Authenticator
The authenticator (hardware or platform) generates and securely stores the private key, which never leaves the device.
Question 3: What does 'defense in depth' mean in the context of an authentication security architecture?
- Using the strongest possible single authentication factor
- Layering multiple independent security controls so that failure of one does not compromise the system (Correct answer)
- Encrypting all data at rest and in transit
- Requiring users to change passwords frequently
Correct answer: Layering multiple independent security controls so that failure of one does not compromise the system
Defense in depth applies multiple overlapping security layers so that an attacker must overcome each layer independently.
Question 4: Which threat model concept refers to an adversary who has already gained a foothold inside the network perimeter?
- External attacker
- Insider threat
- Lateral movement actor (Correct answer)
- Persistent threat agent
Correct answer: Lateral movement actor
Lateral movement describes an attacker who is already inside the network and moves between systems to expand access.
Question 5: How does FIDO2 authentication protect against phishing attacks?
- By requiring a second SMS-based OTP
- By binding credentials to the specific origin (relying party) they were registered with (Correct answer)
- By encrypting the username and password before transmission
- By using a shared secret stored on the server
Correct answer: By binding credentials to the specific origin (relying party) they were registered with
FIDO2 credentials are cryptographically bound to the origin URL at registration, making them unusable on a fraudulent phishing site.
Question 6: Which of the following best describes a 'replay attack' and how FIDO mitigates it?
- An attacker duplicates a valid authentication message; FIDO uses per-authentication challenges (nonces) to prevent reuse (Correct answer)
- An attacker guesses a password; FIDO uses biometrics instead
- An attacker intercepts data in transit; FIDO uses TLS exclusively
- An attacker steals a session cookie; FIDO invalidates cookies after logout
Correct answer: An attacker duplicates a valid authentication message; FIDO uses per-authentication challenges (nonces) to prevent reuse
FIDO authentication responses include a server-generated challenge that is unique per session, so captured responses cannot be replayed.
Question 7: What is the purpose of 'attestation' in FIDO security practices?
- To verify the user's identity via a government ID
- To confirm that an authenticator is a genuine, certified device of a known type (Correct answer)
- To encrypt the credential ID stored on the relying party
- To authorize the user's access rights after authentication
Correct answer: To confirm that an authenticator is a genuine, certified device of a known type
Attestation provides cryptographic proof that a FIDO authenticator is an authentic device from a known manufacturer, allowing relying parties to enforce device policy.
FCP Security Principles and Practices 2
Which security principle states that a user or process should only have the minimum permissions necessary to perform its function?