PQC Foundations · Final assessment

16 questions, 80% to pass

Answer every question you can, then submit. Grading happens on our server, not in your browser, so the score behind your PQC Foundations — Certificate of Completion reflects what you actually chose.

Question 1 of 16

A service uses AES-GCM for records, ECDH for a session key, and ECDSA for a certificate.

Which operation has a direct Shor-related public-key migration need?

Both ECDH and ECDSA.AES-GCM and ECDH only.AES-GCM and ECDSA only.AES-GCM alone.

Question 2 of 16

A news report describes more physical qubits in a new processor.

What conclusion follows for RSA and elliptic-curve security today?

It proves RSA traffic captured today can now be decrypted.It is progress, not proof of a fault-tolerant cryptographic break.It proves ECDSA signatures can now be forged at scale.It proves a fixed calendar date for a future break.

Question 3 of 16

A design has AES-128 for bulk data and RSA-2048 for wrapping a session key.

Which distinction should drive the review?

Both mechanisms share the same Shor exposure.AES has a Shor exposure; RSA only a search consideration.Shor threatens RSA; AES faces quantum search.Neither mechanism needs a quantum-specific review.

Question 4 of 16

A team calls SHA-256 a “256-bit collision-resistant hash.”

What is the technical correction?

Its digest length is its generic collision strength.Its preimage strength is always half its digest length.Its digest size proves a quantum collision cost of 256 bits.A 256-bit digest has about 128-bit generic classical collision strength.

Question 5 of 16

A team lists ML-KEM, ML-DSA, and SLH-DSA as three interchangeable encryption modes.

Which correction fits the published standards?

ML-KEM is a KEM; ML-DSA and SLH-DSA sign.ML-DSA establishes a secret; the other two schemes sign.SLH-DSA establishes a secret; the other two encrypt.All three directly encrypt bulk application messages.

Question 6 of 16

A protocol receives an ML-KEM ciphertext from a peer.

What does successful decapsulation establish by itself?

The peer’s identity, but not a shared secret.A shared secret, not authenticated identity.The integrity of every application message.The validity of the server certificate chain.

Question 7 of 16

A vendor says HQC was selected and therefore is a final FIPS replacement for ML-KEM.

What is the accurate status?

HQC is a final signature standard replacing ML-DSA.HQC is a deprecated classical key-agreement scheme.A selected, not yet standardized, backup KEM.HQC is the required KEM for every current TLS server.

Question 8 of 16

A design review lists FN-DSA beside FIPS 204 as equally finalized.

Which response is accurate?

Both are final NIST FIPS signature standards.FN-DSA is final; ML-DSA remains selected only.Neither has been selected for NIST standardization.FIPS 204 is final; the FN-DSA standard remains under development.

Question 9 of 16

A browser-to-CDN hop negotiated X25519MLKEM768; the CDN-to-origin hop is unobserved.

What can the observation support?

Only the observed hop’s hybrid exchange.Hybrid exchange across both hops and post-quantum certificates.Post-quantum authentication on the observed hop only.No conclusion about any negotiated exchange.

Question 10 of 16

A hybrid TLS pilot retains classical certificate signatures.

Which threat-model statement is defensible?

It blocks every active impersonation attempt by construction.Passive confidentiality can improve; authentication needs separate review.It removes the need to validate certificate chains.It proves each endpoint is quantum-safe in every operation.

Question 11 of 16

An archived software release has a classical signature and a trusted timestamp.

What must long-term validation consider?

Only whether the signature verified on its release date.Only whether the archive remains encrypted today.Evidence preservation and renewal, trust anchors, and later forgery capability.Only whether the signer’s password is still active.

Question 12 of 16

A hypothetical flow has secrecy need X=12 years, migration Y=4 years, and scenario Z=10 years.

What does X+Y>Z indicate?

No planning overlap because X alone exceeds Z.A measured date for a capable quantum computer.Proof that every existing ciphertext will be decrypted.A planning overlap under these assumptions, not proof of captured records.

Question 13 of 16

A record was captured yesterday and has six years of remaining secrecy need. A replacement takes four years.

What time comparison is relevant to that captured record?

Its six remaining secrecy years versus a hypothesized capability horizon.The original retention period plus four migration years.Four migration years alone versus the retention policy.The certificate expiry date plus four migration years.

Question 14 of 16

A planning memo cites NIST IR 8547 as a final ban on P-256 after 2030.

What should be corrected?

It is final; RSA-2048 and P-256 have identical strength.Draft guidance; P-256 and RSA-2048 have different strengths.It is a TLS specification with no transition proposals.It is a final rule that applies only to symmetric keys.

Question 15 of 16

A team has a complete server list but no vendor or protocol-hop evidence.

What is a defensible first migration step?

Wait for every system in the estate to be inventoried.Mark the known servers as fully migrated now.Pilot a bounded flow while expanding the inventory and tracking gaps.Replace all keys without checking peer compatibility.

Question 16 of 16

A library supports ML-KEM, but a partner gateway and hardware module do not.

What does “crypto agile” work require?

Change one configuration key without interoperability testing.Use a permanent classical fallback whenever peers fail.Defer all inventory until the partner upgrades hardware.Peer compatibility, safe fallback, testing, and retirement.

0 of 16 answered. An unanswered question counts as incorrect, so it is safe to submit a partial attempt to see where you stand.