FIDO Compliance, Certification & Interoperability 5

Question 1

Which industry regulation or standard most directly benefits from FIDO-certified authenticators being used as a strong authentication factor?

Accepted Answer

PCI DSS multi-factor authentication requirements

Answer

HIPAA data encryption at rest requirements

Answer

SOX financial reporting controls

Answer

GDPR data minimization principles

Question 2

What distinguishes FIDO Certification Level 1+ (L1+) from standard Level 1?

Accepted Answer

L1+ requires the authenticator to run in a restricted operating environment such as a TEE or SE

Answer

L1+ requires physical tamper evidence on the device

Answer

L1+ allows self-attestation without factory certificates

Answer

L1+ mandates biometric sensor certification

Question 3

When a FIDO-certified authenticator vendor wants to expand into the European market, which additional certification requirement may apply for government use cases?

Accepted Answer

Common Criteria evaluation under eIDAS or national schemes

Answer

FIDO Alliance Level 3+ certification

Answer

ISO 27001 organizational certification

Answer

GDPR Article 25 data-by-design approval

Question 4

In the FIDO Conformance Test Tools, what type of tests are classified as 'P' (positive) tests?

Accepted Answer

Tests that verify the authenticator correctly handles a well-formed, valid request

Answer

Tests that expect the authenticator to reject an invalid request

Answer

Tests that measure the authenticator's response latency

Answer

Tests that simulate a malicious client attacking the authenticator

Question 5

Which FIDO specification defines the biometric performance requirements that a biometric authenticator must meet to achieve Biometric Certification?

Accepted Answer

FIDO Biometric Requirements specification

Answer

FIDO UAF Authenticator Commands

Answer

ISO/IEC 19795 only

Answer

WebAuthn Level 3

Question 6

A FIDO authenticator claims 'basic' attestation. What limitation does this impose on a relying party's trust decisions?

Accepted Answer

Individual authenticators cannot be distinguished, only the device model can be confirmed

Answer

The relying party cannot verify any authenticator properties

Answer

The authenticator cannot store multiple credentials

Answer

The relying party must accept the authenticator unconditionally

Question 7

What is the purpose of the 'fmt' field in a WebAuthn attestation object returned during FIDO certification testing?

Accepted Answer

It identifies which attestation statement format was used so the verifier knows how to parse and validate it

Answer

It specifies the format of the credential's public key

Answer

It indicates the firmware version of the authenticator

Answer

It encodes the relying party's domain in the attestation