FCP Testing and Quality Assurance 2

Question 1

Which FIDO2 test tool is used to verify authenticator conformance before submission to the FIDO Alliance?

Accepted Answer

FIDO Conformance Test Tools (CTT)

Answer

The FIDO Conformance Test Tools (CTT) are the official tools provided by the FIDO Alliance to verify authenticator and server compliance.

Question 2

When testing a FIDO2 authenticator's resident key (discoverable credential) functionality, what is the primary concern?

Accepted Answer

Ensuring the credential is stored on the authenticator and can be listed without a prior user ID

Answer

Discoverable credentials (resident keys) must be stored on the authenticator so the relying party can authenticate without supplying a credential ID.

Question 3

A QA engineer notices that an authenticator returns an aaguid of all zeros in its attestation. What does this indicate?

Accepted Answer

The authenticator is using self-attestation and concealing its model identity

Answer

An all-zeros AAGUID indicates the authenticator is using self-attestation, intentionally hiding its specific model identity.

Question 4

Which test scenario specifically validates that a relying party rejects a registration response where the clientDataJSON origin does not match the expected origin?

Accepted Answer

Origin binding validation test

Answer

Origin binding validation tests confirm that the server rejects registrations where the clientDataJSON origin differs from the expected relying party origin.

Question 5

During CTAP2 interoperability testing, a tester sends a makeCredential command with an unsupported algorithm in pubKeyCredParams. The expected authenticator behavior is to:

Accepted Answer

Return CTAP2_ERR_UNSUPPORTED_ALGORITHM

Answer

CTAP2 specifies that authenticators must return CTAP2_ERR_UNSUPPORTED_ALGORITHM when no algorithm in pubKeyCredParams is supported.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Testing and Quality Assurance 2