FCP Software Development Lifecycle 2 — Questions and Answers
Question 1: During which SDLC phase should a developer first integrate FIDO2 WebAuthn library dependencies into a project?
- Production deployment
- Requirements and design (Correct answer)
- User acceptance testing
- Post-release maintenance
Correct answer: Requirements and design
FIDO2 library selection and integration planning should occur during requirements and design to ensure the architecture supports WebAuthn from the start.
Question 2: A relying party server must store which credential data after a successful FIDO2 registration ceremony?
- The user's private key
- The credential ID and public key (Correct answer)
- The authenticator's PIN
- The client data JSON hash only
Correct answer: The credential ID and public key
The relying party stores the credential ID and the user's public key; the private key never leaves the authenticator.
Question 3: Which HTTP header must a relying party's response include when serving WebAuthn JavaScript to prevent clickjacking attacks during development?
- Strict-Transport-Security
- X-Frame-Options (Correct answer)
- Content-Security-Policy
- Access-Control-Allow-Origin
Correct answer: X-Frame-Options
X-Frame-Options (or the frame-ancestors CSP directive) prevents the page from being embedded in an iframe, protecting against clickjacking.
Question 4: When implementing the FIDO2 authentication ceremony, what value does the server generate and send to the client as a security measure?
- A static session token
- A cryptographic challenge (nonce) (Correct answer)
- The user's credential ID list only
- A pre-shared symmetric key
Correct answer: A cryptographic challenge (nonce)
The server generates a random cryptographic challenge (nonce) that the authenticator signs, preventing replay attacks.
Question 5: In FIDO CTAP2, which transport is mandatory for all Level 1 certified authenticators?
- Bluetooth Low Energy
- USB HID
- NFC
- No transport is universally mandatory at Level 1 (Correct answer)
Correct answer: No transport is universally mandatory at Level 1
FIDO2 Level 1 certification does not mandate a specific transport; authenticators may support USB, NFC, BLE, or internal (platform) transports.
Question 6: During code review of a WebAuthn relying party, a developer notices the server skips verifying the 'rpIdHash' in the authenticator data. What risk does this introduce?
- Performance degradation
- An authenticator from a different origin could be accepted (Correct answer)
- Increased latency during registration
- Incompatibility with older FIDO U2F tokens
Correct answer: An authenticator from a different origin could be accepted
Skipping rpIdHash verification allows credentials bound to a different Relying Party ID to be accepted, breaking the origin-binding security property.
Question 7: Which SDLC artifact should document the attestation verification policy, including accepted attestation types and trusted root certificates?
- User story backlog
- Security architecture document (Correct answer)
- Sprint retrospective notes
- UI wireframes
Correct answer: Security architecture document
The security architecture document is the appropriate artifact to define attestation policy, trusted roots, and verification procedures.
FCP Software Development Lifecycle 2
During which SDLC phase should a developer first integrate FIDO2 WebAuthn library dependencies into a project?