3.5 Identify and Describe Quantum Security Risks (e.g., Harvest Now, Decrypt Later Attacks) and Palo Alto Networks Platform Capabilities to Address Them (e.g., Post-Quantum Readiness, Hybrid Cryptography) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A technology startup is building a new secure messaging application. They want to use post-quantum cryptography for key exchange. Which algorithm should they select for key encapsulation?

   • ASHA-256, a cryptographic hash function
   • BRSA-OAEP, a classical key exchange algorithm with padding
   • CDiffie-Hellman, a classical key exchange algorithm
   • DCRYSTALS-Kyber, a lattice-based key encapsulation mechanism selected by NIST
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   Which Palo Alto Networks capability can help an organization mitigate quantum risks?

   • ASupport for hybrid post-quantum cryptography in VPN and certificate management.
   • BA feature that deletes all encrypted data to prevent future decryption.
   • CA tool that predicts when quantum computers will be available.
   • DAutomatic replacement of all network hardware with quantum computers.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A government agency handles classified data with a 50-year confidentiality requirement. They use Palo Alto Networks firewalls with IPsec VPNs. The security team must decide on a post-quantum strategy. The agency's budget is limited, and they cannot afford to replace all hardware. Which approach best balances security and cost?

   • AReplace all firewalls with new models that support post-quantum algorithms natively
   • BIncrease the RSA key size to 4096 bits on all VPN connections
   • CEnable hybrid cryptography on the firewalls to protect VPN key exchanges while maintaining compatibility with existing endpoints
   • DDisable all VPN connections and use a different, non-cryptographic data transfer method
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   What is Palo Alto Networks' overall approach to post-quantum readiness?

   • AThey are actively integrating post-quantum algorithms into their products and providing a roadmap for migration.
   • BThey are developing their own quantum computer to test their products.
   • CThey recommend that customers wait until quantum computers are available before making any changes.
   • DThey have decided to continue using only classical cryptography and ignore quantum risks.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security engineer is explaining to a colleague why quantum computers are a threat to public-key cryptography. The colleague asks, 'Why can't we just use larger key sizes to protect against quantum attacks?' What is the most accurate response?

   • ALarger key sizes help, but only if the key is changed frequently
   • BLarger key sizes help, but they are too slow to be practical
   • CLarger key sizes help, but only for symmetric algorithms like AES
   • DLarger key sizes do not help because Shor's algorithm can solve the mathematical problems underlying RSA and ECC in polynomial time, regardless of key size
   Reveal Solution Discussion Select an answer first