FCP Testing and Quality Assurance 4

Question 1

Which FIDO Alliance resource provides the authoritative metadata for FIDO authenticators used to validate attestation trust chains during testing?

Accepted Answer

FIDO Metadata Service (MDS)

Answer

FIDO Conformance Test Tools

Answer

WebAuthn Validator API

Answer

FIDO Alliance GitHub repository

Question 2

A tester is verifying that an NFC authenticator correctly handles transport disconnection mid-operation. The expected CTAP behavior is:

Accepted Answer

The operation is aborted and the authenticator returns to a ready state without completing the credential

Answer

The authenticator buffers the operation and completes it on reconnection

Answer

The server automatically retries the operation on the next request

Answer

The authenticator stores partial state and resumes on the next NFC tap

Question 3

When testing a FIDO2 implementation's handling of extensions, what is the correct behavior if an authenticator receives an unknown extension marked as not critical?

Accepted Answer

The authenticator should ignore the unknown extension and proceed normally

Answer

The authenticator should return an error for any unrecognized extension

Answer

The authenticator should include the unknown extension in its response unchanged

Answer

The authenticator should request the extension definition from the FIDO Alliance

Question 4

In a FIDO2 QA environment, a test verifies that the RP ID hash in authenticatorData matches the SHA-256 hash of the relying party's expected RP ID. This test guards against:

Accepted Answer

Cross-origin credential usage where a fraudulent site tries to use credentials from another domain

Answer

Weak key generation during credential creation

Answer

Improper encoding of the attestation object

Answer

Buffer overflow in the CBOR parser

Question 5

What is the significance of testing the 'at' (attested credential data included) flag in authenticatorData during a makeCredential response?

Accepted Answer

It confirms the authenticator included the AAGUID, credential ID, and public key in the response

Answer

It verifies the user was physically present during registration

Answer

It indicates user verification was performed with a PIN

Answer

It signals that a backup-eligible credential was created

Question 6

A security test submits a WebAuthn registration response with a modified clientDataJSON to the server. The server must detect this because:

Accepted Answer

The hash of clientDataJSON (clientDataHash) is included in the data signed by the authenticator, so any modification breaks the signature

Answer

The server independently re-fetches clientDataJSON from the browser

Answer

CBOR encoding detects any modifications to JSON fields

Answer

The authenticator stores a copy of clientDataJSON for comparison

Question 7

When validating FIDO2 server behavior with the 'allowCredentials' list in a getAssertion request, what happens if the list is empty?

Accepted Answer

The authenticator performs a resident key (discoverable credential) assertion without needing a credential ID hint

Answer

The server must reject the request as malformed

Answer

The authenticator returns an error for missing credential IDs

Answer

The authentication defaults to U2F mode