FCP Software Development Lifecycle 3

Question 1

Which type of testing specifically validates that a FIDO2 authenticator's attestation statement is signed by a trusted root in the FIDO Metadata Service?

Accepted Answer

Attestation verification testing

Answer

Attestation verification testing confirms that the server correctly validates attestation statements against trusted roots from the FIDO MDS.

Question 2

A QA engineer wants to simulate a replay attack against a WebAuthn implementation. Which value should they attempt to reuse across two authentication requests?

Accepted Answer

The server-issued challenge

Answer

A replay attack involves reusing a previously captured signed challenge response; the server must reject challenges it has already processed.

Question 3

When threat modeling a FIDO2 relying party, which STRIDE category best describes an attacker cloning a software authenticator's private key material?

Accepted Answer

Spoofing

Answer

Cloning private key material allows an attacker to impersonate a legitimate authenticator, which is a spoofing threat.

Question 4

In a CI/CD pipeline for a FIDO relying party, which automated test should run on every pull request to catch regressions in ceremony validation logic?

Accepted Answer

Unit tests for authenticator data parsing and verification

Answer

Unit tests for authenticator data parsing and verification catch regressions quickly and run without physical hardware in any CI environment.

Question 5

A developer tests FIDO2 registration in a localhost environment. Why might the browser reject the PublicKeyCredentialCreationOptions?

Accepted Answer

The rpId does not match the current origin's effective domain

Answer

The rpId must be a registrable domain suffix of the page's origin; if it doesn't match, the browser rejects the options.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Software Development Lifecycle 3