3.5 Identify and Describe Quantum Security Risks (e.g., Harvest Now, Decrypt Later Attacks) and Palo Alto Networks Platform Capabilities to Address Them (e.g., Post-Quantum Readiness, Hybrid Cryptography) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 6)

Questions 26–30

1. 26foundation · medium

   Which of the following cryptographic algorithms is most vulnerable to a quantum computer running Shor's algorithm?

   • ARSA
   • BHMAC-SHA256
   • CSHA-256
   • DAES-256
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A defense contractor stores design documents for a weapons system that must remain classified for 30 years. The CISO is concerned about an adversary who has been intercepting and storing encrypted network traffic for the past two years. Which threat model is the CISO most accurately describing?

   • AA downgrade attack, where the adversary forces the use of weaker cryptographic protocols to make interception easier
   • BA brute-force attack, where the adversary attempts every possible key to decrypt the stored traffic immediately
   • CA man-in-the-middle attack, where the adversary actively intercepts and modifies traffic in real time to capture plaintext
   • DA harvest now, decrypt later attack, where encrypted data is collected today and decrypted once a sufficiently powerful quantum computer exists
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A university research lab uses Palo Alto Networks firewalls to protect their network. They are collaborating with other institutions and need to ensure that their VPN connections are future-proof. The lab director asks the network administrator what Palo Alto Networks' post-quantum readiness roadmap includes. What is the most accurate description?

   • AA phased roadmap that includes support for hybrid cryptography and migration to NIST-standardized post-quantum algorithms
   • BAn immediate switch to post-quantum-only algorithms on all firewalls
   • CA plan to replace all hardware with quantum computers for encryption
   • DNo roadmap, as quantum computers are not a realistic threat
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A multinational corporation uses Palo Alto Networks firewalls for inter-site VPNs. They are preparing for post-quantum migration but are concerned about interoperability with third-party VPN gateways that do not yet support post-quantum algorithms. What is the best way to deploy hybrid cryptography in this environment?

   • ADisable hybrid cryptography and use only classical algorithms until all peers support post-quantum algorithms
   • BUse post-quantum-only algorithms on all Palo Alto Networks firewalls and force all peers to comply
   • CEnable hybrid cryptography on the Palo Alto Networks firewalls and configure them to negotiate post-quantum algorithms when the peer supports them, falling back to classical algorithms otherwise
   • DRequire all third-party gateways to upgrade to post-quantum support before enabling hybrid cryptography on any firewall
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A cybersecurity analyst is explaining to a non-technical executive why quantum computers are a threat to current encryption. The executive asks, 'What is the fundamental difference between a quantum bit and a classical bit that makes quantum computers so powerful?' What is the most accurate explanation?

   • AA qubit is always in a state of 1, which makes it more reliable than a classical bit
   • BA qubit is physically smaller than a classical bit, allowing more of them to be packed into a smaller space
   • CA qubit can only be 0 or 1, but it switches between them much faster than a classical bit
   • DA qubit can exist in a superposition of 0 and 1 simultaneously, allowing quantum computers to process many possibilities at once
   Reveal Solution Discussion Select an answer first