FCP Software Development Lifecycle 2

Question 1

During which SDLC phase should a developer first integrate FIDO2 WebAuthn library dependencies into a project?

Accepted Answer

Requirements and design

Answer

FIDO2 library selection and integration planning should occur during requirements and design to ensure the architecture supports WebAuthn from the start.

Question 2

A relying party server must store which credential data after a successful FIDO2 registration ceremony?

Accepted Answer

The credential ID and public key

Answer

The relying party stores the credential ID and the user's public key; the private key never leaves the authenticator.

Question 3

Which HTTP header must a relying party's response include when serving WebAuthn JavaScript to prevent clickjacking attacks during development?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options (or the frame-ancestors CSP directive) prevents the page from being embedded in an iframe, protecting against clickjacking.

Question 4

When implementing the FIDO2 authentication ceremony, what value does the server generate and send to the client as a security measure?

Accepted Answer

A cryptographic challenge (nonce)

Answer

The server generates a random cryptographic challenge (nonce) that the authenticator signs, preventing replay attacks.

Question 5

In FIDO CTAP2, which transport is mandatory for all Level 1 certified authenticators?

Accepted Answer

No transport is universally mandatory at Level 1

Answer

FIDO2 Level 1 certification does not mandate a specific transport; authenticators may support USB, NFC, BLE, or internal (platform) transports.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Software Development Lifecycle 2