FCP Testing and Quality Assurance 4

Question 1

Which FIDO Alliance resource provides the authoritative metadata for FIDO authenticators used to validate attestation trust chains during testing?

Accepted Answer

FIDO Metadata Service (MDS)

Answer

The FIDO Metadata Service (MDS) provides authenticator metadata including attestation root certificates needed to validate trust chains.

Question 2

A tester is verifying that an NFC authenticator correctly handles transport disconnection mid-operation. The expected CTAP behavior is:

Accepted Answer

The operation is aborted and the authenticator returns to a ready state without completing the credential

Answer

CTAP requires that authenticators treat transport disconnection as an operation abort, returning to a clean state without partially creating credentials.

Question 3

When testing a FIDO2 implementation's handling of extensions, what is the correct behavior if an authenticator receives an unknown extension marked as not critical?

Accepted Answer

The authenticator should ignore the unknown extension and proceed normally

Answer

Non-critical unknown extensions must be silently ignored by the authenticator, allowing forward compatibility with future extension definitions.

Question 4

In a FIDO2 QA environment, a test verifies that the RP ID hash in authenticatorData matches the SHA-256 hash of the relying party's expected RP ID. This test guards against:

Accepted Answer

Cross-origin credential usage where a fraudulent site tries to use credentials from another domain

Answer

Verifying the RP ID hash ensures the credential was created for the correct relying party and cannot be used cross-origin by a phishing site.

Question 5

What is the significance of testing the 'at' (attested credential data included) flag in authenticatorData during a makeCredential response?

Accepted Answer

It confirms the authenticator included the AAGUID, credential ID, and public key in the response

Answer

The 'at' flag must be set in makeCredential responses, indicating the attested credential data (AAGUID, credential ID, public key) is present.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Testing and Quality Assurance 4