how does criteria work about on-device-authentication?

Hi, I'm preparing for certification and struggling with implementing on-device-authentication. But I wonder if I have to exactly follow the flow shown as follows:  To be more specific, is it po...