FIDO Risk Assessment & Mitigation 2

Question 1

Which attack vector is FIDO2 specifically designed to eliminate compared to password-based authentication?

Accepted Answer

Phishing and credential replay attacks

Answer

FIDO2 binds credentials to a specific origin, making phishing and replay attacks cryptographically impossible.

Question 2

An enterprise is concerned that employees may clone FIDO hardware authenticator keys. Which FIDO property directly mitigates this risk?

Accepted Answer

Device-bound private keys that cannot be exported

Answer

FIDO authenticators store private keys in secure hardware that prevents extraction, making cloning infeasible.

Question 3

A threat model identifies a risk of an attacker intercepting authentication traffic. Why does this pose minimal risk in a FIDO deployment?

Accepted Answer

Each authentication response uses a unique challenge and is bound to the origin

Answer

FIDO signatures are scoped to a unique server challenge and the specific origin, rendering intercepted responses useless for replay.

Question 4

Which FIDO authenticator characteristic reduces the risk of a compromised authenticator affecting multiple relying parties?

Accepted Answer

A unique credential key pair generated per relying party

Answer

FIDO generates a unique key pair for each relying party, so compromise at one site does not expose credentials at others.

Question 5

In a FIDO risk assessment, 'user presence' verification is classified as which level of assurance compared to 'user verification'?

Accepted Answer

Lower, because it does not confirm the user's identity

Answer

User presence only confirms physical access to the device, while user verification (PIN/biometric) additionally confirms the identity of the person.

(FIDO) FIDO Certified Authenticator Practice Test