FCP Testing and Quality Assurance 5

Question 1

During interoperability testing between a CTAP2.1 authenticator and a CTAP2.0 client library, which backward compatibility requirement must be verified?

Accepted Answer

The CTAP2.1 authenticator must correctly respond to CTAP2.0 commands without requiring CTAP2.1-specific fields

Answer

The CTAP2.0 client must upgrade to CTAP2.1 before any communication

Answer

Both parties must negotiate a common extension set before authenticating

Answer

The authenticator must downgrade its cryptographic algorithms to CTAP2.0 defaults

Question 2

A test engineer wants to verify that a FIDO server correctly implements the 'token binding' extension. What is the primary purpose of this extension in the context of FIDO testing?

Accepted Answer

To cryptographically bind the WebAuthn authentication to the TLS session, preventing token export attacks

Answer

To bind the user's biometric template to the credential key

Answer

To associate the credential with a specific hardware security module

Answer

To link the authentication token to the user's account identifier

Question 3

In UAF testing, what does the 'FinalChallengeParams' verification step ensure?

Accepted Answer

That the UAF client correctly relayed the server's challenge to the authenticator without modification

Answer

That the ASM correctly signed the final challenge parameters before passing them to the authenticator

Answer

That the challenge was generated with sufficient entropy by the server

Answer

That the final response includes valid user verification data

Question 4

A QA team is testing large blob (largeBlob) extension support on a FIDO2.1 authenticator. Which test case is most critical for security validation?

Accepted Answer

Verify that largeBlob data from one credential cannot be accessed by a different credential on the same authenticator

Answer

Confirm the maximum blob size exceeds 64KB

Answer

Test that blobs are compressed before storage

Answer

Ensure the blob is transmitted in plaintext for debugging purposes

Question 5

When performing regression testing after updating a FIDO2 server library, which test is most critical to include?

Accepted Answer

Re-validating that previously registered credentials can still successfully authenticate (backward compatibility of stored credential data)

Answer

Testing all new CTAP2.1 extensions added in the update

Answer

Verifying the updated library supports all attestation formats for new registrations only

Answer

Confirming that the server's certificate was renewed during the update

Question 6

What is the correct test to verify that a FIDO2 authenticator properly enforces PIN retry limits?

Accepted Answer

Submit incorrect PINs up to the maximum retry count and verify the authenticator blocks further attempts until unlocked or reset

Answer

Verify the PIN is stored in encrypted form in the authenticator's secure element

Answer

Confirm the PIN can be changed without knowledge of the old PIN after a lockout

Answer

Test that the PIN entropy requirement rejects PINs shorter than 6 characters

Question 7

A FIDO certification test suite reports a failure on the 'credProtect' extension test. Which scenario most likely caused the failure?

Accepted Answer

The authenticator allowed a getAssertion without user verification for a credential created with credProtect level 3

Answer

The authenticator rejected a registration request for a non-resident credential

Answer

The server failed to include the credProtect extension in the registration options

Answer

The AAGUID was missing from the authenticator data during assertion