FCP exam prep - is the cryptography depth harder than FIDO's study materials suggest?
I'm a security architect with about 8 years of experience and I'm working toward the FCP designation. I've been through the FIDO Alliance's official prep materials and they feel lighter than I expected for a professional-level credential. Wondering if that's representative of the actual exam or if the real questions go significantly deeper.
My background in asymmetric cryptography and PKI is solid so the fundamental concepts aren't the issue. What I'm less sure about is how deeply the exam tests FIDO2 and WebAuthn implementation specifics versus broader zero-trust and passwordless architecture concepts. Those are pretty different prep paths.
I've been studying about 90 minutes a day for 4 weeks. The authenticator attestation and CTAP2 protocol sections are where I'm spending extra time because those feel like they could go either way in terms of depth. Sitting in about 2 weeks.
I passed with a 79% and found the enterprise deployment and policy sections heavier than expected. Risk tradeoffs between different authenticator types in different enterprise contexts came up multiple times throughout.
The WebAuthn spec details are tested but not at spec-reading depth. Level of detail is closer to what does clientDataJSON contain and why rather than byte-level implementation. Your PKI background will carry you through most of it.
The exam leans more toward architecture and deployment scenarios than deep protocol implementation. Know your authenticator types cold - platform vs roaming, attestation formats, and the trust model - but it's not a debugging exercise.
Just passed FCP last month and yeah, the official materials are definitely lighter than the actual exam. The cryptography questions go deeper than FIDO's prep suggests, especially around key derivation functions and attestation certificate chains. I'd spent a lot of time on passkey flows but honestly didn't expect to get quizzed so hard on the underlying CBOR encoding and COSE key structures.
The thing that made the difference for me was reading the WebAuthn spec directly instead of relying on summaries. It's dense but the exam clearly rewards people who've actually worked through the normative language rather than just the explainer docs. If you've got 8 years as a security architect you'll pick it up fast, it just takes a couple focused evenings to really internalize the attestation trust model at the level they expect.
Yeah, I failed my first attempt and cryptography was exactly where I got burned. The FIDO materials cover the concepts but they don't really stress-test your applied understanding -- like, knowing what AES-GCM is versus actually knowing when and why you'd choose it over something else in a specific deployment scenario. I thought I had it and I really didn't.
Second time around I spent a lot more time on NIST publications and worked through some practical scenarios instead of just reading definitions. It's less about memorizing algorithms and more about threat modeling around them, if that makes sense. With your architect background you'll probably pick it up faster than I did, but don't let the study guide lull you into thinking it's surface-level stuff.
Quick update from my end -- I just finished a timed practice run last night and scored 74%, which I'm honestly pretty happy with considering I've only been seriously prepping for about three weeks. The cryptography stuff wasn't as brutal as I feared, though the questions on elliptic curve implementations caught me off guard a couple times.
I'm planning to sit the actual exam in late July, so I've got a few more weeks to shore up the weak spots. If your background is in security architecture you'll probably find the conceptual stuff clicks pretty fast -- it's more about the specific framing of questions than depth of knowledge, at least from what I've seen in practice sets.