Final assessment · PQC for Leaders

Question 1 of 12

A board asks what decision is needed before every cryptographic asset is known.

Which request is accountable?

Fund owned discovery with a decision gate.Approve a fixed estate-wide completion date now.Accept every business-unit risk without review.Wait for an exact quantum-computer arrival date.

Question 2 of 12

Engineering reports a candidate hybrid pilot but uncertain partner compatibility.

Which decision belongs to leadership?

Select the exact KEM parameter set for engineers.Set scope, fund testing, and assign ownership.Declare the partner compliant from a slide deck.Skip pilot evidence to preserve the schedule.

Question 3 of 12

A vendor cites final NIST algorithms as proof a device upgrade is ready.

What should the sponsor ask?

Whether NIST has finalized every future algorithm.Whether the draft guidance is binding worldwide.Which product, peers, and obligation were validated?Whether the vendor’s marketing date is recent.

Question 4 of 12

A memo calls NIST IR 8547 a final law binding every organization in 2030.

What correction is required?

The memo is correct because the year is explicit.Only the draft title needs updating.Replace the date with an unsourced earlier year.It is draft guidance; check applicability.

Question 5 of 12

A dashboard says 80 classical-key findings were found in 100 known services.

What is missing for prioritization?

Secrecy, capture paths, impact, dependencies, and evidence.A larger count of weak algorithms only.The organization’s total employee count.A promise to migrate all 80 at once.

Question 6 of 12

A customer-record flow has a sampled classical origin hop; a device fleet has a two-year OEM dependency.

What is a reasonable program choice?

Migrate the flow and ignore the device dependency.Pilot the flow and start device design.Start the device work and cancel all flow sampling.Rank both solely by exposed IP addresses.

Question 7 of 12

A unit reports “100% inventory coverage” using 80 rows; 108 assets and flows are in the estate list.

What follow-up is most useful?

Accept the percentage because it has a denominator.Replace the inventory with a vendor slide.Reconcile the denominator, missing assets, and evidence.Ask only how many cryptographic libraries exist.

Question 8 of 12

A CFO requests a full-year figure before discovery is complete.

Which funding response is defensible?

Refuse to give any estimate until every system is known.Provide an exact fixed cost with no stated uncertainty.Fund only whichever service is cheapest to migrate.Offer a provisional range with review gates.

Question 9 of 12

A vendor requests an 18-month exception from origin migration, naming no controls.

What should the risk owner do first?

Request residual-risk evidence and alternatives.Approve because the request has an end date.Reject without considering the dependency.Remove the origin from the dashboard.

Question 10 of 12

Two teams disagree about who can accept a migration exception.

Which governance change closes the gap?

Let the vendor choose its own exception authority.Document decision authority, asset owner, register fields, and escalation path.Assign the decision to whoever is on call.Stop recording exceptions until policy is final.

Question 11 of 12

A team says its edge supports a hybrid group and therefore the service is “fully post-quantum.”

What evidence should a leader request?

Only the edge software version number.Only the number of TLS certificates.Negotiated groups by hop, signatures, peer coverage, dates, and gaps.Only the vendor’s product-roadmap quarter.

Question 12 of 12

A release gate catches a classical fallback after a migration pilot.

What should the board-facing status include?

A green status because a gate existed.A deleted finding after the next release.A claim that every other system is unaffected.Affected flows, exposure, owner, fix, regression test, and updated coverage.

0 of 12 answered. An unanswered question counts as incorrect, so it is safe to submit a partial attempt to see where you stand.