FCP Software Development Lifecycle 3 — Questions and Answers
Question 1: Which type of testing specifically validates that a FIDO2 authenticator's attestation statement is signed by a trusted root in the FIDO Metadata Service?
- Load testing
- Attestation verification testing (Correct answer)
- Smoke testing
- Regression testing
Correct answer: Attestation verification testing
Attestation verification testing confirms that the server correctly validates attestation statements against trusted roots from the FIDO MDS.
Question 2: A QA engineer wants to simulate a replay attack against a WebAuthn implementation. Which value should they attempt to reuse across two authentication requests?
- The user's display name
- The server-issued challenge (Correct answer)
- The allowed credentials list
- The client's user agent string
Correct answer: The server-issued challenge
A replay attack involves reusing a previously captured signed challenge response; the server must reject challenges it has already processed.
Question 3: When threat modeling a FIDO2 relying party, which STRIDE category best describes an attacker cloning a software authenticator's private key material?
- Spoofing (Correct answer)
- Tampering
- Repudiation
- Elevation of privilege
Correct answer: Spoofing
Cloning private key material allows an attacker to impersonate a legitimate authenticator, which is a spoofing threat.
Question 4: In a CI/CD pipeline for a FIDO relying party, which automated test should run on every pull request to catch regressions in ceremony validation logic?
- Manual penetration test
- Unit tests for authenticator data parsing and verification (Correct answer)
- Load tests simulating 10,000 users
- End-to-end browser tests with physical hardware tokens
Correct answer: Unit tests for authenticator data parsing and verification
Unit tests for authenticator data parsing and verification catch regressions quickly and run without physical hardware in any CI environment.
Question 5: A developer tests FIDO2 registration in a localhost environment. Why might the browser reject the PublicKeyCredentialCreationOptions?
- Localhost is never a valid effective Relying Party ID
- The challenge was not Base64URL encoded correctly
- The rpId does not match the current origin's effective domain (Correct answer)
- WebAuthn requires a minimum of two user verification factors
Correct answer: The rpId does not match the current origin's effective domain
The rpId must be a registrable domain suffix of the page's origin; if it doesn't match, the browser rejects the options.
Question 6: Which tool category is most appropriate for fuzzing the CBOR-encoded authenticator data parsing code of a FIDO2 server library?
- Static application security testing (SAST)
- Software composition analysis (SCA)
- Coverage-guided fuzzer (Correct answer)
- Interactive application security testing (IAST)
Correct answer: Coverage-guided fuzzer
Coverage-guided fuzzers generate malformed CBOR inputs and track code coverage to find parsing bugs and crashes efficiently.
Question 7: During integration testing of a FIDO UAF client, the test fails because the ASM (Authenticator Specific Module) returns error code 0x06. What does this typically indicate?
- Key storage is full
- User verification was cancelled
- No suitable authenticator was found (Correct answer)
- The command is not supported
Correct answer: No suitable authenticator was found
FIDO UAF ASM error code 0x06 (NO_SUITABLE_AUTHENTICATOR) means no authenticator meeting the policy requirements was discovered.
FCP Software Development Lifecycle 3
Which type of testing specifically validates that a FIDO2 authenticator's attestation statement is signed by a trusted root in the FIDO Metadata Service?