PQC Foundations · Final assessment

16 questions, 80% to pass

Answer every question you can, then submit. Grading happens on our server, not in your browser, so the score behind your PQC Foundations — Certificate of Completion reflects what you actually chose.

Question 1 of 16

Which family of cryptography does Shor's algorithm threaten, and why?

Symmetric cryptography, such as AES, because it relies on brute-force search resistance.Public-key cryptography, such as RSA, Diffie-Hellman, and ECC, because their security rests on integer factorization and the discrete logarithm problem.Hash functions, such as SHA-256, because they rely on collision resistance.All cryptography equally, because quantum computers break any mathematical problem.

Question 2 of 16

A vendor's slide claims: 'Our quantum computer has a large number of qubits, so RSA-2048 will be broken within two years.'

What is the most accurate response, based on this course?

Agree — qubit count is a reliable predictor of when RSA will be broken.Disagree — Shor's algorithm requires a large, fault-tolerant quantum computer that does not exist today; raw physical qubit counts are not evidence of a timeline, and this course does not predict one.Disagree — Shor's algorithm cannot break RSA-2048 under any circumstances.Agree, but only because the specific qubit count mentioned is the known threshold for breaking RSA-2048.

Question 3 of 16

A team is deciding whether to increase its AES key size in response to quantum computing. Which statement reflects current NIST guidance?

AES-128 is now considered broken and must be replaced immediately.Grover's algorithm gives a quadratic speedup against symmetric key search; NIST continues to consider AES-128 acceptable, and AES-256 leaves ample margin.AES key sizes are irrelevant to quantum computing, because Grover's algorithm only targets hash functions.AES-256 must be replaced entirely with a post-quantum algorithm, not merely resized.

Question 4 of 16

Which statement about hash functions is accurate?

SHA-256 is practically broken by quantum computers and must be replaced with a post-quantum hash algorithm.SHA-2 and SHA-3 are not practically broken by quantum computers; SHA-256 remains acceptable, and longer digests give more margin.Hash functions are exempt from all quantum-era guidance because they are not used in key exchange.Only SHA-3 is acceptable in a post-quantum context; SHA-2 has already been deprecated.

Question 5 of 16

NIST published its first finalized post-quantum cryptography standards on which date, and what did they cover?

13 August 2024 — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA).13 August 2024 — HQC and FN-DSA as the first finalized standards.March 2025 — FIPS 203, 204, and 205, alongside the selection of HQC.13 August 2024 — a single combined standard covering both key exchange and signatures.

Question 6 of 16

Which pairing correctly matches a standard to its purpose and origin?

FIPS 203 / ML-KEM — a digital signature scheme derived from CRYSTALS-Dilithium.FIPS 204 / ML-DSA — a digital signature scheme derived from CRYSTALS-Dilithium.FIPS 205 / SLH-DSA — a key-encapsulation mechanism derived from SPHINCS+.FIPS 203 / ML-KEM — a digital signature scheme derived from CRYSTALS-Kyber.

Question 7 of 16

What is HQC, and what is its current status?

A finalized FIPS standard for digital signatures, published alongside ML-DSA.A backup key-encapsulation mechanism selected in March 2025, built on code-based mathematics distinct from ML-KEM's lattice-based foundation; its standard is still in progress.The successor to ML-KEM, intended to fully replace it once finalized.A hash-based signature scheme intended for firmware signing.

Question 8 of 16

What is the status of FN-DSA, the FALCON-based signature standard?

Finalized and published as a FIPS standard.Drafted but not yet final.Withdrawn after a classical break was found in FALCON.Identical in status to ML-DSA — both finalized on the same date.

Question 9 of 16

A signature scheme's security rests only on the properties of a cryptographic hash function, with no other mathematical assumption. Which family does this describe, and which standard is an example?

Lattice-based; ML-DSA.Code-based; HQC.Hash-based; SLH-DSA.Lattice-based; ML-KEM.

Question 10 of 16

A CDN reports that most inbound TLS 1.3 connections now negotiate X25519MLKEM768.

What does that tell you, and what does it not tell you?

It confirms the handshake confidentiality is protected against harvest-now-decrypt-later; it says nothing about whether the server certificate is signed with a post-quantum signature.It confirms both the handshake and the certificate chain are fully post-quantum.It means the connection no longer uses any classical cryptography at any layer.It has no security meaning; X25519MLKEM768 is purely a compatibility identifier.

Question 11 of 16

Why does harvest-now-decrypt-later treat confidentiality and authentication differently?

Because authentication is not affected by quantum computers at all, so it never needs migrating.Because a recorded, encrypted session can be decrypted later if the key exchange is broken, whereas a past signature verification cannot be retroactively undone — though long-lived roots of trust and code-signing keys still need migrating before a capable quantum computer exists.Because signatures are always quantum-safe by design, unlike encryption.Because confidentiality only matters for regulated data, while authentication matters for all data equally.

Question 12 of 16

In Mosca's inequality (X + Y > Z means exposure has already occurred), which variable does this course identify as the one an organization actually controls?

Z, the time until a capable quantum computer exists.X, how long the data must remain confidential.Y, how long migration takes.None of the three variables can be influenced by an organization.

Question 13 of 16

A risk committee wants a specific calendar date by which a capable quantum computer will exist, to plan the migration deadline around it.

What does this course say about supplying that date?

A specific date can be derived reliably from current qubit-count announcements.No such date should be predicted; the standard practice is to use Mosca's inequality and regulatory milestones as planning inputs instead of a predicted quantum-computing deadline.NIST has already published an official date for when RSA will be broken.The date is always exactly ten years from the present, regardless of when the question is asked.

Question 14 of 16

What is the current status of NIST IR 8547, and what does it propose?

A finalized rule that immediately disallows RSA-2048 and ECDSA P-256.An initial public draft proposing deprecation of 112-bit-security classical public-key algorithms after 2030, and disallowing them after 2035.A finalized standard requiring migration to ML-KEM by the end of this decade.A withdrawn proposal, superseded by CNSA 2.0.

Question 15 of 16

Which algorithms does NSA's CNSA 2.0 name for US National Security Systems, and what is its rough timeline?

ML-KEM-1024 and ML-DSA-87, with LMS/XMSS for firmware signing, on milestones running through the early 2030s.RSA-4096 and ECDSA P-521, to be phased out by 2028.HQC and FN-DSA exclusively, since these are the newest standards.SLH-DSA only, for all key exchange and signature use cases.

Question 16 of 16

A CTO asks for a short justification for starting a post-quantum migration program this year, rather than waiting for more certainty.

Which justification best reflects this course's guidance?

Wait — nothing should start until HQC and FN-DSA are finalized and a firm date for a capable quantum computer is published.Start now — inventory is typically the longest step, standards already exist for most use cases (ML-KEM, ML-DSA, SLH-DSA), hybrid key exchange is already deployable, and migration time is the one variable in Mosca's inequality the organization controls.Start now, but only to satisfy NIST IR 8547, since no other justification applies before 2030.Wait until another organization publicly completes a similar migration, then replicate its approach.

0 of 16 answered. An unanswered question counts as incorrect, so it is safe to submit a partial attempt to see where you stand.