3.5 Identify and Describe Quantum Security Risks (e.g., Harvest Now, Decrypt Later Attacks) and Palo Alto Networks Platform Capabilities to Address Them (e.g., Post-Quantum Readiness, Hybrid Cryptography) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A cloud service provider stores customer data for a variety of clients, including those with short-term (1 year) and long-term (30 year) confidentiality requirements. They use Palo Alto Networks firewalls. The security architect must decide whether to enable hybrid cryptography now or wait. What is the most defensible decision?

   • AEnable hybrid cryptography now to protect all data, prioritizing the long-term confidentiality data that is most at risk
   • BEnable hybrid cryptography only for the long-term confidentiality data, leaving short-term data unprotected
   • CDisable all encryption to avoid the complexity of hybrid cryptography
   • DWait until NIST finalizes all post-quantum standards before enabling any quantum-resistant features
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   Which fundamental property of quantum computing is the primary reason it threatens current public-key cryptographic systems?

   • AQuantum computers can clone quantum states, allowing them to duplicate cryptographic keys and decrypt traffic.
   • BQuantum computers can instantly break any encryption by observing the encrypted data without interacting with it.
   • CQuantum computers can store unlimited data in a single qubit, allowing them to bypass encryption by brute force.
   • DQuantum bits can exist in a superposition of states, enabling parallel computation that can solve certain mathematical problems exponentially faster.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial institution is reviewing its encryption standards. The security team identifies that their VPN tunnels use RSA-2048 for key exchange and AES-256 for data encryption. The CISO asks which of these algorithms is most at risk from a future quantum computer. What is the correct assessment?

   • ABoth RSA-2048 and AES-256 are equally at risk because quantum computers break all symmetric and asymmetric algorithms
   • BNeither algorithm is at risk because current quantum computers are not powerful enough to break either algorithm
   • CAES-256 is at risk because Grover's algorithm can search the key space quadratically faster, reducing its effective security
   • DRSA-2048 is at risk because Shor's algorithm can efficiently factor large numbers, breaking RSA's mathematical foundation
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   What is the primary goal of a harvest now, decrypt later attack?

   • ATo trick users into revealing their passwords through phishing, then decrypt their stored data.
   • BTo capture encrypted data today and decrypt it in the future when a sufficiently powerful quantum computer becomes available.
   • CTo collect large amounts of plaintext data to train quantum machine learning models.
   • DTo harvest cryptographic keys from a system's memory and use them immediately to decrypt live traffic.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A global bank uses Palo Alto Networks firewalls for its branch office VPNs. The security team is implementing hybrid cryptography but is concerned about performance overhead. The bank's network carries high-volume, low-latency trading traffic. What is the most important consideration when deploying hybrid cryptography in this environment?

   • AThe requirement to replace all branch office firewalls with higher-end models
   • BThe performance impact of hybrid cryptography on the firewall's throughput and latency, which must be tested and validated
   • CThe need to disable all other security features to free up resources for hybrid cryptography
   • DThe need to use only post-quantum algorithms, as hybrid cryptography is too slow
   Reveal Solution Discussion Select an answer first