FIDO Case Analysis & Practical Application 2

Question 1

A bank deploys FIDO2 authentication but their legacy mobile app only supports SMS OTP. Which migration strategy best maintains backward compatibility while advancing security?

Accepted Answer

Run SMS OTP and FIDO2 in parallel, letting users opt into FIDO2 progressively

Answer

A parallel deployment allows existing users to continue with SMS OTP while new and upgrading users adopt FIDO2, minimizing disruption.

Question 2

A user reports their FIDO security key works on a Windows PC but fails on a Chromebook. Which root cause should be investigated first?

Accepted Answer

The security key transport (USB-HID) may not be permitted by enterprise Chromebook policy

Answer

Enterprise Chromebook policies can restrict USB device access, preventing HID-class authenticators from being recognized.

Question 3

During a FIDO2 registration ceremony, the Relying Party receives an attestation statement with fmt='packed' but cannot verify the certificate chain. What should the RP do?

Accepted Answer

Reject the registration because attestation verification failure is a security risk

Answer

If the RP's policy requires verified attestation and verification fails, the registration must be rejected to prevent enrollment of untrusted authenticators.

Question 4

A healthcare provider wants FIDO authentication but requires that private keys never leave hardware. Which authenticator category satisfies this requirement?

Accepted Answer

Roaming authenticators with hardware-backed secure elements

Answer

Roaming authenticators with dedicated secure elements (e.g., hardware security keys) generate and store private keys in tamper-resistant hardware that prevents key extraction.

Question 5

An enterprise FIDO deployment logs authentication failures with error code 'InvalidStateError'. What scenario most likely causes this?

Accepted Answer

A registration was attempted with an authenticator that already has a credential for that RP

Answer

InvalidStateError is thrown during registration when the authenticator already contains a discoverable credential for the same RP, preventing duplicate registrations.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Case Analysis & Practical Application 2