FIDO Professional Standards & Competencies 3 — Questions and Answers
Question 1: A relying party wants to accept only hardware security keys, not platform authenticators. Which WebAuthn parameter should it set?
- authenticatorAttachment: 'platform'
- authenticatorAttachment: 'cross-platform' (Correct answer)
- userVerification: 'required'
- attestationConveyance: 'direct'
Correct answer: authenticatorAttachment: 'cross-platform'
Setting authenticatorAttachment to 'cross-platform' restricts the credential request to roaming authenticators such as USB or NFC security keys.
Question 2: Which FIDO2 feature enables a user to authenticate on a new device using their phone as a FIDO authenticator via Bluetooth proximity?
- Resident Key delegation
- Hybrid transport (caBLE/CTAP2.1) (Correct answer)
- Silent authentication extension
- Token Binding
Correct answer: Hybrid transport (caBLE/CTAP2.1)
The Hybrid transport (also called caBLE) in CTAP2.1 allows a phone to act as a cross-device FIDO authenticator via Bluetooth proximity.
Question 3: In a FIDO conformance testing scenario, which error code indicates that an authenticator refused a request because the origin was not authorized?
- CTAP2_ERR_UNSUPPORTED_ALGORITHM
- CTAP2_ERR_OPERATION_DENIED (Correct answer)
- CTAP2_ERR_INVALID_CBOR
- CTAP2_ERR_PIN_REQUIRED
Correct answer: CTAP2_ERR_OPERATION_DENIED
CTAP2_ERR_OPERATION_DENIED is returned when the authenticator denies the operation, which includes unauthorized origin scenarios.
Question 4: According to FIDO best practices, how should a relying party handle an attestation statement with attestation type 'none'?
- Reject the registration outright
- Accept it if the credential is otherwise valid and trust requirements allow it (Correct answer)
- Require re-registration with a certified authenticator
- Escalate to the FIDO Alliance for review
Correct answer: Accept it if the credential is otherwise valid and trust requirements allow it
Self-attestation ('none') is valid; relying parties may accept it if their trust policy permits unverified authenticator models.
Question 5: What is the role of the 'rpId' in FIDO2, and what determines its valid scope?
- It is a globally unique user identifier scoped to the authenticator
- It identifies the relying party and must be a registrable domain suffix of the origin (Correct answer)
- It is an opaque token generated per authentication session
- It maps to a user account number stored in the authenticator
Correct answer: It identifies the relying party and must be a registrable domain suffix of the origin
The rpId must be a registrable domain suffix of the effective origin, scoping the credential to the appropriate site(s).
Question 6: Which FIDO certification level requires the authenticator to undergo physical penetration testing by an accredited lab?
- L1
- L1+
- L2
- L3+ (Correct answer)
Correct answer: L3+
FIDO Authenticator Level 3+ (L3+) requires rigorous physical security testing including penetration testing by an accredited evaluation laboratory.
Question 7: A professional is implementing large blob storage extension on a FIDO2 authenticator. What key constraint must they observe?
- Large blob data is encrypted by the server and stored in the cloud
- The extension requires a discoverable credential and reports available storage size in authenticatorGetInfo (Correct answer)
- Large blobs must be Base64-encoded before passing to the authenticator
- The large blob extension is only available for UAF authenticators
Correct answer: The extension requires a discoverable credential and reports available storage size in authenticatorGetInfo
The largeBlobKey extension requires a resident (discoverable) credential, and the authenticator reports its large blob storage capacity in the authenticatorGetInfo response.
FIDO Professional Standards & Competencies 3
A relying party wants to accept only hardware security keys, not platform authenticators.
Which WebAuthn parameter should it set?