FCP Security Principles and Practices 2

Question 1

Which security principle states that a user or process should only have the minimum permissions necessary to perform its function?

Accepted Answer

Least privilege

Answer

Least privilege limits the access rights for users, accounts, and computing processes to only what is strictly required to perform their intended tasks.

Question 2

In FIDO2, which component is responsible for creating and storing private keys used during authentication?

Accepted Answer

Authenticator

Answer

The authenticator (hardware or platform) generates and securely stores the private key, which never leaves the device.

Question 3

What does 'defense in depth' mean in the context of an authentication security architecture?

Accepted Answer

Layering multiple independent security controls so that failure of one does not compromise the system

Answer

Defense in depth applies multiple overlapping security layers so that an attacker must overcome each layer independently.

Question 4

Which threat model concept refers to an adversary who has already gained a foothold inside the network perimeter?

Accepted Answer

Lateral movement actor

Answer

Lateral movement describes an attacker who is already inside the network and moves between systems to expand access.

Question 5

How does FIDO2 authentication protect against phishing attacks?

Accepted Answer

By binding credentials to the specific origin (relying party) they were registered with

Answer

FIDO2 credentials are cryptographically bound to the origin URL at registration, making them unusable on a fraudulent phishing site.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Security Principles and Practices 2