FCP Testing and Quality Assurance 5

Question 1

During interoperability testing between a CTAP2.1 authenticator and a CTAP2.0 client library, which backward compatibility requirement must be verified?

Accepted Answer

The CTAP2.1 authenticator must correctly respond to CTAP2.0 commands without requiring CTAP2.1-specific fields

Answer

CTAP2.1 is backward compatible with CTAP2.0, meaning authenticators must handle CTAP2.0 commands correctly even when supporting additional CTAP2.1 features.

Question 2

A test engineer wants to verify that a FIDO server correctly implements the 'token binding' extension. What is the primary purpose of this extension in the context of FIDO testing?

Accepted Answer

To cryptographically bind the WebAuthn authentication to the TLS session, preventing token export attacks

Answer

Token binding ties the WebAuthn assertion to the TLS connection, ensuring the authentication token cannot be replayed over a different TLS session.

Question 3

In UAF testing, what does the 'FinalChallengeParams' verification step ensure?

Accepted Answer

That the UAF client correctly relayed the server's challenge to the authenticator without modification

Answer

The FinalChallengeParams verification step ensures the UAF client correctly transmitted the server-generated challenge to the authenticator without tampering.

Question 4

A QA team is testing large blob (largeBlob) extension support on a FIDO2.1 authenticator. Which test case is most critical for security validation?

Accepted Answer

Verify that largeBlob data from one credential cannot be accessed by a different credential on the same authenticator

Answer

Credential isolation for largeBlob storage is critical; each credential's blob must be inaccessible to other credentials to prevent data leakage.

Question 5

When performing regression testing after updating a FIDO2 server library, which test is most critical to include?

Accepted Answer

Re-validating that previously registered credentials can still successfully authenticate (backward compatibility of stored credential data)

Answer

Regression testing must confirm existing credentials stored before the update continue to work, as library changes can affect public key parsing or signature validation.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Testing and Quality Assurance 5