FCP Security Principles and Practices 3 — Questions and Answers
Question 1: In a zero-trust security model, what is the foundational assumption that drives access control decisions?
- All internal network traffic is trusted by default
- No entity — internal or external — is implicitly trusted; every request must be verified (Correct answer)
- Firewalls provide sufficient perimeter protection
- Authenticated users retain trust for the duration of their session
Correct answer: No entity — internal or external — is implicitly trusted; every request must be verified
Zero trust eliminates the concept of a trusted internal network, requiring continuous verification of every access request regardless of origin.
Question 2: Which cryptographic property ensures that a signer cannot later deny having created a digital signature?
- Integrity
- Confidentiality
- Non-repudiation (Correct answer)
- Availability
Correct answer: Non-repudiation
Non-repudiation means a party cannot credibly deny the authenticity of their signature because only they hold the private key used to create it.
Question 3: What is a 'credential stuffing' attack and which FIDO property directly mitigates it?
- Brute-forcing PINs; mitigated by lockout policies
- Using stolen username/password pairs from breaches; mitigated by phishing-resistant, site-bound FIDO credentials (Correct answer)
- Injecting malicious scripts; mitigated by input sanitization
- Intercepting tokens over HTTP; mitigated by requiring HTTPS
Correct answer: Using stolen username/password pairs from breaches; mitigated by phishing-resistant, site-bound FIDO credentials
Credential stuffing reuses breached passwords across sites; FIDO passkeys are site-bound asymmetric credentials with no reusable secret, so there is nothing to stuff.
Question 4: Which FIDO2 security requirement ensures that an authenticator cannot be silently cloned by malware on the host device?
- Transport encryption via TLS
- Client PIN requirement
- Private key non-exportability enforced by the authenticator's secure element or TPM (Correct answer)
- Server-side credential revocation
Correct answer: Private key non-exportability enforced by the authenticator's secure element or TPM
FIDO authenticators store private keys in hardware-protected enclaves (secure element, TPM) that prevent key extraction, making cloning infeasible.
Question 5: An organization wants to enforce that only FIPS-certified authenticators can be used. Which FIDO mechanism supports this policy?
- Requiring a minimum credential ID length
- Filtering allowed authenticators using AAGUID via attestation metadata (Correct answer)
- Configuring longer timeout values in PublicKeyCredentialRequestOptions
- Disabling cross-platform authenticators in the relying party
Correct answer: Filtering allowed authenticators using AAGUID via attestation metadata
The AAGUID (Authenticator Attestation GUID) uniquely identifies the authenticator model; relying parties use the FIDO Metadata Service to look up certification status and enforce policy.
Question 6: What security risk does 'authenticator binding' address in enterprise FIDO deployments?
- Preventing users from registering authenticators on unauthorized devices (Correct answer)
- Encrypting the authenticator's internal storage
- Ensuring biometric templates are never transmitted over the network
- Limiting the number of credentials per user account
Correct answer: Preventing users from registering authenticators on unauthorized devices
Authenticator binding policies allow enterprises to restrict which physical devices can be enrolled, preventing rogue or personal devices from being registered.
Question 7: Which principle does FIDO's 'local verification' model implement by keeping biometric data on the device?
- Security through obscurity
- Data minimization and privacy by design (Correct answer)
- Mandatory access control
- Separation of duties
Correct answer: Data minimization and privacy by design
FIDO performs biometric matching locally on the authenticator and never transmits biometric data to the server, embodying privacy-by-design and data minimization principles.
FCP Security Principles and Practices 3
In a zero-trust security model, what is the foundational assumption that drives access control decisions?