FIDO Professional Standards & Competencies 2 — Questions and Answers
Question 1: Which FIDO Alliance working group is primarily responsible for defining authenticator certification levels?
- Certification Working Group (CWG) (Correct answer)
- Technical Working Group (TWG)
- FIDO Deployment Working Group
- Identity Verification Working Group
Correct answer: Certification Working Group (CWG)
The Certification Working Group (CWG) oversees authenticator certification programs and defines the levels and requirements.
Question 2: A FIDO2 authenticator must store a resident credential (discoverable credential) in which location?
- Cloud storage linked to the platform
- Authenticator's secure internal storage (Correct answer)
- The relying party's server
- The browser's local storage
Correct answer: Authenticator's secure internal storage
Discoverable credentials must be stored in the authenticator's secure internal storage so they can be presented without a credential ID hint.
Question 3: What is the primary purpose of the 'aaguid' field in a FIDO2 attestation statement?
- To uniquely identify the individual user
- To indicate the type and model of the authenticator (Correct answer)
- To store the relying party's identifier
- To encode the public key algorithm
Correct answer: To indicate the type and model of the authenticator
The AAGUID (Authenticator Attestation GUID) identifies the make and model of an authenticator, enabling relying parties to look up its metadata.
Question 4: Under FIDO professional standards, when implementing UV (User Verification) on a mobile authenticator, which biometric evaluation criterion is most critical?
- FAR (False Acceptance Rate) must be below 1/10,000 (Correct answer)
- FRR (False Rejection Rate) must be below 1%
- The biometric template must be transmitted to the server
- User enrollment must be completed remotely
Correct answer: FAR (False Acceptance Rate) must be below 1/10,000
FIDO standards require biometric authenticators to achieve a FAR of less than 1/10,000 to ensure strong user verification.
Question 5: Which attestation type allows a relying party to verify the authenticator model without the authenticator manufacturer being involved in each attestation?
- Self Attestation
- Full Basic Attestation
- Surrogate Attestation
- Anonymization CA Attestation (Correct answer)
Correct answer: Anonymization CA Attestation
Anonymization CA (AnonCA) attestation uses a CA that issues per-device certificates, allowing model verification while preserving privacy without per-transaction manufacturer involvement.
Question 6: A FIDO Certified professional is reviewing a deployment where users report being prompted for a PIN on every login. Which setting should be investigated first?
- clientPin is set to required in authenticatorGetInfo
- The RP is requesting UV=required without caching policy (Correct answer)
- The attestation type is set to 'none'
- The AAGUID is not registered in the MDS
Correct answer: The RP is requesting UV=required without caching policy
When the relying party sets UV=required without allowing UV caching, the authenticator must verify the user on every assertion.
Question 7: What does the FIDO Metadata Service (MDS) provide to relying parties?
- Real-time user authentication logs
- Trustworthy metadata about certified authenticator models (Correct answer)
- A directory of registered user credentials
- Live revocation status of individual credentials
Correct answer: Trustworthy metadata about certified authenticator models
The FIDO MDS provides signed metadata statements about authenticator models, enabling relying parties to make informed trust decisions during registration.
FIDO Professional Standards & Competencies 2
Which FIDO Alliance working group is primarily responsible for defining authenticator certification levels?