HNDL Fundamentals · Final assessment

14 questions, 80% to pass

Answer every question you can, then submit. Grading happens on our server, not in your browser, so the score behind your HNDL Fundamentals — Certificate of Completion reflects what you actually chose.

Question 1 of 14

An attacker records encrypted sessions today and keeps the ciphertext for years.

When is this specifically an HNDL concern?

When later decryption reveals still-sensitive plaintext.Whenever an attacker can read plaintext at capture time.Only after an attacker forges a future signing key.Only when the traffic uses a symmetric cipher.

Question 2 of 14

A press release reports a larger quantum device.

What does that change in an HNDL review?

It proves every stored TLS record can be read now.It may inform scenarios, but does not prove a cryptographically relevant break exists.It sets a reliable deadline for every migration.It eliminates uncertainty about captured traffic.

Question 3 of 14

A signed firmware image was distributed publicly and will remain trusted for ten years.

Which issue is separate from decrypting captured ciphertext?

A past signature check being erased from history.The public image becoming confidential by signing.Future forgery and long-term signature verification.A symmetric record key becoming known by signature use.

Question 4 of 14

A backup contains an encrypted private signing key; a public firmware image carries a classical signature.

How should these be assessed?

As one HNDL ciphertext with identical capture requirements.As harmless because neither artifact is internet-facing.As solved by migrating the live TLS key exchange alone.Separately: backup confidentiality path and public-artifact authenticity lifetime.

Question 5 of 14

A contract is retained for 20 years but all confidentiality duties end after three.

What is the relevant X estimate today?

Three remaining secrecy years, subject to data-owner confirmation.Twenty years because that is the retention policy.Zero years because it is not a health record.An unknown quantum-computer arrival date.

Question 6 of 14

An internal-only service exports encrypted archives to a managed vendor.

What harvestability finding is justified?

Internal addressing proves no attacker can capture it.Check vendor copies, access, and key artifacts before calling it unharvestable.Vendor retention proves every archive is breakable.Only live internet traffic can be harvested.

Question 7 of 14

An archive is encrypted with a random data key that is wrapped with RSA.

Which captured set could enable later recovery?

Archive ciphertext and its file extension only.The RSA public key without the wrapped key.Archive ciphertext, RSA-wrapped key, and corresponding public-key context.The symmetric cipher name and retention policy.

Question 8 of 14

A record uses an independent symmetric wrapping key generated offline; no vulnerable exchange path has been found.

What is the careful conclusion?

The record is categorically immune to all future compromise.The record must be RSA-protected because it is encrypted.The record is exposed whenever its cipher is named AES.No identified public-key recovery path; continue custody review.

Question 9 of 14

A vendor claims “PQC supported” in a two-year-old brochure; a current sample shows classical origin negotiation.

How should the evidence register read?

Record the observed classical hop, the stale claim, confidence, and a vendor verification task.Overwrite the sample with the broader vendor claim.Treat all vendor paths as proven classical-only.Remove the origin hop from the inventory.

Question 10 of 14

A service uses an unknown key-wrap mechanism; its owner has not provided artifacts.

How should a planner record it?

Observed value classical-only with high confidence.Observed value unknown; use an explicit conservative assumption pending verification.Observed value post-quantum with low confidence.No row until certainty is available.

Question 11 of 14

A hypothetical future flow has X=8, Y=5, and scenario Z=10 years.

What does the comparison show?

X+Y=13 proves every current record is already compromised.X+Y=3 falls below Z, so the flow needs no review.X+Y=13 exceeds Z; the scenario supports earlier action, not a date prediction.X+Y cannot be compared until Z is certain.

Question 12 of 14

A record was captured last year; its remaining secrecy is two years. Migration takes five.

What matters to this particular captured copy?

Five migration years alone prove the copy is exposed.Original record retention alone determines exposure.Migrating future sessions erases this stored copy.Remaining secrecy and the captured protection path.

Question 13 of 14

Flow A has long-lived data and a sampled classical hop; flow B is high impact but its vendor hop is unknown.

What is a defensible first tranche?

Pilot A and investigate B’s hop in parallel, then revisit the order.Declare A permanently higher priority based on one sample.Defer both until the entire enterprise inventory is complete.Treat B as post-quantum protected without vendor evidence.

Question 14 of 14

A third flow has short secrecy but a shared key service required by several long-lived flows.

How can dependencies change sequencing?

Its short-lived data makes the service irrelevant.The shared service may be an early enabler even if its own data is short-lived.Its network address alone determines its order.Dependencies should be ignored in quantum planning.

0 of 14 answered. An unanswered question counts as incorrect, so it is safe to submit a partial attempt to see where you stand.