FCP Testing and Quality Assurance 3

Question 1

In FIDO conformance testing, what does the 'packed' attestation format test specifically verify?

Accepted Answer

That the signature over authenticatorData and clientDataHash uses the attested credential's key or a batch key

Answer

That the credential counter starts at zero

Answer

That the AAGUID matches the metadata statement

Answer

That the transport hint includes USB

Question 2

Which metric is most important when performing load testing on a FIDO2 server's assertion endpoint?

Accepted Answer

Signature verification latency under concurrent authentication requests

Answer

Number of attestation formats supported

Answer

Average credential counter increment rate

Answer

CBOR decoding throughput for registration only

Question 3

A tester is validating UV (user verification) behavior. The relying party sets userVerification to 'required' but the authenticator returns the UV flag as 0. What is the correct server response?

Accepted Answer

Reject the assertion with an error because user verification was required but not performed

Answer

Accept the assertion since user presence is still confirmed

Answer

Downgrade to U2F mode automatically

Answer

Request a second factor from the user

Question 4

What is the correct test to verify replay attack protection in a FIDO2 server implementation?

Accepted Answer

Submit the same valid assertion response twice and confirm the server rejects the second attempt

Answer

Check that the challenge is at least 16 bytes long

Answer

Verify that clientDataJSON includes the crossOrigin field

Answer

Confirm the attestation certificate has not expired

Question 5

During testing of the credential counter, a QA engineer observes the authenticator returns a counter value lower than the last stored value. What should a FIDO2-compliant server do?

Accepted Answer

Flag the credential as potentially cloned and refuse the authentication

Answer

Accept the assertion but log a warning

Answer

Reset the counter to the new value and continue

Answer

Request re-registration of the credential

Question 6

When testing FIDO UAF client-to-ASM (Authenticator-Specific Module) communication, which interface is being exercised?

Accepted Answer

The UAF Client API defined in the UAF Authenticator Transport Binding specification

Answer

The CTAP2 protocol over USB HID

Answer

The WebAuthn Level 2 JavaScript API

Answer

The FIDO metadata service REST endpoint

Question 7

A QA tester is verifying that a FIDO2 server correctly handles the 'none' attestation format. What is the expected server behavior when attestation is 'none' but the relying party requires direct attestation?

Accepted Answer

The server should reject the registration because the required attestation was not provided

Answer

The server should accept 'none' attestation as a fallback for all policies

Answer

The server should request a new registration with a different authenticator

Answer

The server should query the FIDO metadata service for the missing attestation