FIDO Professional Standards & Competencies 3

Question 1

A relying party wants to accept only hardware security keys, not platform authenticators. Which WebAuthn parameter should it set?

Accepted Answer

authenticatorAttachment: 'cross-platform'

Answer

Setting authenticatorAttachment to 'cross-platform' restricts the credential request to roaming authenticators such as USB or NFC security keys.

Question 2

Which FIDO2 feature enables a user to authenticate on a new device using their phone as a FIDO authenticator via Bluetooth proximity?

Accepted Answer

Hybrid transport (caBLE/CTAP2.1)

Answer

The Hybrid transport (also called caBLE) in CTAP2.1 allows a phone to act as a cross-device FIDO authenticator via Bluetooth proximity.

Question 3

In a FIDO conformance testing scenario, which error code indicates that an authenticator refused a request because the origin was not authorized?

Accepted Answer

CTAP2_ERR_OPERATION_DENIED

Answer

CTAP2_ERR_OPERATION_DENIED is returned when the authenticator denies the operation, which includes unauthorized origin scenarios.

Question 4

According to FIDO best practices, how should a relying party handle an attestation statement with attestation type 'none'?

Accepted Answer

Accept it if the credential is otherwise valid and trust requirements allow it

Answer

Self-attestation ('none') is valid; relying parties may accept it if their trust policy permits unverified authenticator models.

Question 5

What is the role of the 'rpId' in FIDO2, and what determines its valid scope?

Accepted Answer

It identifies the relying party and must be a registrable domain suffix of the origin

Answer

The rpId must be a registrable domain suffix of the effective origin, scoping the credential to the appropriate site(s).

(FIDO) FIDO Certified Authenticator Practice Test