FCP Security Principles and Practices 3

Question 1

In a zero-trust security model, what is the foundational assumption that drives access control decisions?

Accepted Answer

No entity — internal or external — is implicitly trusted; every request must be verified

Answer

Zero trust eliminates the concept of a trusted internal network, requiring continuous verification of every access request regardless of origin.

Question 2

Which cryptographic property ensures that a signer cannot later deny having created a digital signature?

Accepted Answer

Non-repudiation

Answer

Non-repudiation means a party cannot credibly deny the authenticity of their signature because only they hold the private key used to create it.

Question 3

What is a 'credential stuffing' attack and which FIDO property directly mitigates it?

Accepted Answer

Using stolen username/password pairs from breaches; mitigated by phishing-resistant, site-bound FIDO credentials

Answer

Credential stuffing reuses breached passwords across sites; FIDO passkeys are site-bound asymmetric credentials with no reusable secret, so there is nothing to stuff.

Question 4

Which FIDO2 security requirement ensures that an authenticator cannot be silently cloned by malware on the host device?

Accepted Answer

Private key non-exportability enforced by the authenticator's secure element or TPM

Answer

FIDO authenticators store private keys in hardware-protected enclaves (secure element, TPM) that prevent key extraction, making cloning infeasible.

Question 5

An organization wants to enforce that only FIPS-certified authenticators can be used. Which FIDO mechanism supports this policy?

Accepted Answer

Filtering allowed authenticators using AAGUID via attestation metadata

Answer

The AAGUID (Authenticator Attestation GUID) uniquely identifies the authenticator model; relying parties use the FIDO Metadata Service to look up certification status and enforce policy.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Security Principles and Practices 3