Below is the default values in the SKFS FIDO Policy "checkResolutions" JSON object that determines whether the SKFS will accept an authenticator if it's AAGUID is missing from the MDS, the attestation object has an absent x5c, or if it has an invalid certificate. 

"mds": {
  ... ,
  "checkResolutions": {
    "enabled": true,
    "noAaguidInMds": "ACCEPT",
    "hasX5c": {
      "hasMdsAttestation": {
        "invalidPkix": "DENY"
      },
      "noMdsAttestation": {
        "invalidPkix": "DENY"
      }
    },
    "noX5c": {
      "hasMdsAttestation": {
        "formatNone": "DENY",
        "formatPacked": "DENY"
      },
      "noMdsAttestation": "ACCEPT"
    }
}

When performing initial authenticator checks, the SKFS makes checks between the authenticator attestation statement object against the cached MDS. The SKFS will perform the checks in the SKFS FIDO Policy snippet mentioned above and act accordingly. It can either DENY, or ACCEPT the request.