FCP exam prep - is the cryptography depth harder than FIDO's study materials suggest?
I'm a security architect with about 8 years of experience and I'm working toward the FCP designation. I've been through the FIDO Alliance's official prep materials and they feel lighter than I expected for a professional-level credential. Wondering if that's representative of the actual exam or if the real questions go significantly deeper.
My background in asymmetric cryptography and PKI is solid so the fundamental concepts aren't the issue. What I'm less sure about is how deeply the exam tests FIDO2 and WebAuthn implementation specifics versus broader zero-trust and passwordless architecture concepts. Those are pretty different prep paths.
I've been studying about 90 minutes a day for 4 weeks. The authenticator attestation and CTAP2 protocol sections are where I'm spending extra time because those feel like they could go either way in terms of depth. Sitting in about 2 weeks.
I passed with a 79% and found the enterprise deployment and policy sections heavier than expected. Risk tradeoffs between different authenticator types in different enterprise contexts came up multiple times throughout.
The WebAuthn spec details are tested but not at spec-reading depth. Level of detail is closer to what does clientDataJSON contain and why rather than byte-level implementation. Your PKI background will carry you through most of it.
The exam leans more toward architecture and deployment scenarios than deep protocol implementation. Know your authenticator types cold - platform vs roaming, attestation formats, and the trust model - but it's not a debugging exercise.
Just passed FCP last month and yeah, the official materials are definitely lighter than the actual exam. The cryptography questions go deeper than FIDO's prep suggests, especially around key derivation functions and attestation certificate chains. I'd spent a lot of time on passkey flows but honestly didn't expect to get quizzed so hard on the underlying CBOR encoding and COSE key structures.
The thing that made the difference for me was reading the WebAuthn spec directly instead of relying on summaries. It's dense but the exam clearly rewards people who've actually worked through the normative language rather than just the explainer docs. If you've got 8 years as a security architect you'll pick it up fast, it just takes a couple focused evenings to really internalize the attestation trust model at the level they expect.
Yeah, I failed my first attempt and cryptography was exactly where I got burned. The FIDO materials cover the concepts but they don't really stress-test your applied understanding -- like, knowing what AES-GCM is versus actually knowing when and why you'd choose it over something else in a specific deployment scenario. I thought I had it and I really didn't.
Second time around I spent a lot more time on NIST publications and worked through some practical scenarios instead of just reading definitions. It's less about memorizing algorithms and more about threat modeling around them, if that makes sense. With your architect background you'll probably pick it up faster than I did, but don't let the study guide lull you into thinking it's surface-level stuff.
Quick update from my end -- I just finished a timed practice run last night and scored 74%, which I'm honestly pretty happy with considering I've only been seriously prepping for about three weeks. The cryptography stuff wasn't as brutal as I feared, though the questions on elliptic curve implementations caught me off guard a couple times.
I'm planning to sit the actual exam in late July, so I've got a few more weeks to shore up the weak spots. If your background is in security architecture you'll probably find the conceptual stuff clicks pretty fast -- it's more about the specific framing of questions than depth of knowledge, at least from what I've seen in practice sets.
Honestly, the FIDO materials are lighter than the actual exam. I went through the same thing — felt pretty comfortable after the official prep, then got humbled pretty fast when I started doing practice runs. The cryptography section goes deeper than you'd expect, especially around attestation chains and how hardware roots of trust actually work in practice. I squeezed in studying early mornings before my kids woke up, maybe 45 minutes a day, and the fcp/questions/fido attestation and metadata questions were some of the trickiest I found.
With 8 years of experience you won't be starting from zero, but don't assume that covers the gaps. I'd recommend going beyond the official materials specifically on authenticator attestation formats and metadata service verification — that stuff showed up more than I expected. Slow and steady honestly worked for me, even part-time it's doable if you're consistent.
Honestly, I almost dropped out about halfway through. The FIDO materials felt so surface-level that I convinced myself the exam had to be a joke or I was studying wrong. Cryptography depth? Yeah, it goes deeper than what they give you. The attestation stuff especially -- I spent an extra two weeks just on fcp/questions/fido attestation and metadata because the official prep barely scratches it.
Keep going. It wasn't easy and there were definitely moments I thought my 8 years of experience would carry me and it didn't. The exam respects the credential. You'll need to actually understand the crypto, not just recognize the terms.