# SEAS-8414 Chapter 7 Homework
## Blackboard Multiple-Choice Assessment: Post-Quantum Cryptographic Readiness

**Use:** Due before the next Chapter 8 class session
**Total Points:** 100
**Format:** 50 single-correct-answer multiple choice questions, 2 points each
**Audience:** Doctoral students and senior cybersecurity practitioners

This assessment is designed for Blackboard delivery. Every item is multiple choice
with exactly one correct answer. The assessment is closed book: do not use the
textbook, notes, internet search, lab files, scanners, AI tools, or outside
incident writeups while answering.

Each question includes a scenario-provenance label. That label is a citation
trail for instructors and is never required to choose the answer. Every formula,
threshold, rule, or evidence contract required to answer appears inside the stem.

Chapter boundary: answer only within Chapter 7 post-quantum cryptographic readiness for IoT/OT platforms only. Do not import capabilities
from other chapters unless the stem explicitly defines them.

---

### Question 1

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network applies Mosca-style Chapter 7 HNDL screening. The rule in this question is: HNDL is active when data_sensitivity_years + migration_years >= years_until_CRQC. The data sensitivity horizon is 12 years, migration takes 2 years, and the CRQC planning horizon is 9 years. Which verdict and margin follow? Margin is sensitivity + migration - CRQC.

(a) not-yet-HNDL-active; margin 5 years
(b) HNDL-active; margin 1 years
(c) HNDL-active; margin -5 years
(d) HNDL-active; margin 5 years
### Question 2

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority reviews symmetric encryption for sensor telemetry. The Chapter 7 rule stated here is: post-Grover effective strength is symmetric_key_bits/2, and long-horizon IoT/OT confidentiality requires at least 128 effective bits. The channel uses AES-256. Which result follows?

(a) 128 effective bits; falls below the 128-bit post-Grover floor
(b) No determinate answer can be computed from the stated rule.
(c) 128 effective bits; passes the 128-bit post-Grover floor
(d) 256 effective bits; passes the 128-bit post-Grover floor
### Question 3

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator costs a Chapter 7 migration plan. Firmware-updated devices cost $180 each, gateway-proxy devices cost $950 each, VPN-overlay devices cost $420 each, and each validation cohort costs $1,200. Cohorts are ceil(total_devices/25). The plan has 36 firmware devices, 6 proxy devices, and 11 VPN-overlay devices. Which total cost follows?

(a) $80,400
(b) $20,400
(c) $16,800
(d) $43,500
### Question 4

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator classifies TLS services. The local Chapter 7 rule for this question is: RSA key exchange is quantum-vulnerable; ECDHE_RSA and hybrid ECDHE+ML-KEM are transitional; pure ML-KEM key exchange is PQ-ready. The fleet has 6 RSA-key-exchange services, 10 ECDHE_RSA services, 3 hybrid services, and 5 pure ML-KEM services. Which count tuple is correct in the order vulnerable / transitional / PQ-ready?

(a) 6 / 13 / 5
(b) 16 / 3 / 5
(c) 6 / 10 / 8
(d) 0 / 19 / 5
### Question 5

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant measures cryptographic agility for an OT gateway. The score is +35 for TLS 1.3 support, +25 for accepting a hybrid key-share group, +20 for a vendor firmware migration path, and +20 for a tested rollback. Status is agile for score >=70, constrained for 40-69, and blocked for <40. The observed components are TLS1.3=True, hybrid_group=False, vendor_path=True, rollback=True. Which status follows?

(a) score 95; agile
(b) score 75; blocked
(c) score 50; constrained
(d) score 75; agile
### Question 6

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network runs 10,000 Chapter 7 CRQC timeline trials. The local escalation rule is: escalate only when P(CRQC before data-retention end) >= 0.25 and exposed traffic is greater than 1.0 TB. 1,078 trials land before the retention end, and exposed traffic is 1.5 TB. Which result follows?

(a) P=1.078; escalate
(b) P=0.892; monitor
(c) P=0.108; monitor
(d) P=0.108; escalate
### Question 7

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program computes a migration start year. The rule is start_by = min(cert_expiry_year - validation_years, CRQC_year - retention_years - migration_years). Current year is 2026. Inputs: cert_expiry=2028, validation=2, CRQC=2038, retention=11, migration=4. Which start year and urgency follow?

(a) 2027; start in future
(b) 2023; already late
(c) 2026; start in future
(d) 2030; start in future
### Question 8

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative evaluates side-channel deployment risk for an ARM-class IoT device. The score is 0.35 if the implementation is not constant-time, 0.25 if memory access is secret-dependent, 0.20 if masking is absent, and 0.20 if the device shares an observable power rail. Risk is high for score >=0.70, medium for 0.35-0.69, and low below 0.35. Observed: not_constant_time=False, secret_dependent_memory=False, no_masking=False, shared_power_rail=False. Which score and class follow?

(a) 0.00; low
(b) 0.20; low
(c) No determinate answer can be computed from the stated rule.
(d) 0.00; high
### Question 9

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site ranks two cryptographic migration candidates. The Chapter 7 priority formula is priority = HNDL_margin_years*12 + exposed_TB*3 + criticality*8 - migration_cost_thousands. Candidate A has margin=2, exposed_TB=2, criticality=5, cost_thousands=7. Candidate B has priority 56. Which ranking follows?

(a) Candidate A priority 63; B ranks first
(b) Candidate A priority 70; A ranks first
(c) Candidate A priority 2; B ranks first
(d) Candidate A priority 63; A ranks first
### Question 10

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program computes a Chapter 7 quantum migration risk score for an IoT/OT service. The self-contained formula is risk = 0.40*KEX + 0.20*AUTH + 0.15*RETENTION + 0.15*AGILITY + 0.10*SIDE. RETENTION is min(100, retention_years*4). The service has KEX=30, AUTH=20, retention_years=21, AGILITY=65, and SIDE=25. Which score follows?

(a) 44.8
(b) 43.4
(c) 40.9
(d) 28.2
### Question 11

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority applies Mosca-style Chapter 7 HNDL screening. The rule in this question is: HNDL is active when data_sensitivity_years + migration_years >= years_until_CRQC. The data sensitivity horizon is 8 years, migration takes 2 years, and the CRQC planning horizon is 13 years. Which verdict and margin follow? Margin is sensitivity + migration - CRQC.

(a) not-yet-HNDL-active; margin 3 years
(b) not-yet-HNDL-active; margin -3 years
(c) HNDL-active; margin -3 years
(d) not-yet-HNDL-active; margin -7 years
### Question 12

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility reviews symmetric encryption for sensor telemetry. The Chapter 7 rule stated here is: post-Grover effective strength is symmetric_key_bits/2, and long-horizon IoT/OT confidentiality requires at least 128 effective bits. The channel uses AES-128. Which result follows?

(a) 64 effective bits; falls below the 128-bit post-Grover floor
(b) 128 effective bits; passes the 128-bit post-Grover floor
(c) 64 effective bits; passes the 128-bit post-Grover floor
(d) 0 effective bits; falls below the 128-bit post-Grover floor
### Question 13

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network costs a Chapter 7 migration plan. Firmware-updated devices cost $180 each, gateway-proxy devices cost $950 each, VPN-overlay devices cost $420 each, and each validation cohort costs $1,200. Cohorts are ceil(total_devices/25). The plan has 20 firmware devices, 6 proxy devices, and 13 VPN-overlay devices. Which total cost follows?

(a) $14,760
(b) $27,940
(c) $61,560
(d) $17,160
### Question 14

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority classifies TLS services. The local Chapter 7 rule for this question is: RSA key exchange is quantum-vulnerable; ECDHE_RSA and hybrid ECDHE+ML-KEM are transitional; pure ML-KEM key exchange is PQ-ready. The fleet has 2 RSA-key-exchange services, 11 ECDHE_RSA services, 7 hybrid services, and 5 pure ML-KEM services. Which count tuple is correct in the order vulnerable / transitional / PQ-ready?

(a) 2 / 11 / 12
(b) 0 / 20 / 5
(c) 2 / 18 / 5
(d) 13 / 7 / 5
### Question 15

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator measures cryptographic agility for an OT gateway. The score is +35 for TLS 1.3 support, +25 for accepting a hybrid key-share group, +20 for a vendor firmware migration path, and +20 for a tested rollback. Status is agile for score >=70, constrained for 40-69, and blocked for <40. The observed components are TLS1.3=True, hybrid_group=True, vendor_path=True, rollback=True. Which status follows?

(a) score 75; agile
(b) score 100; agile
(c) score 120; agile
(d) score 100; blocked
### Question 16

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator runs 10,000 Chapter 7 CRQC timeline trials. The local escalation rule is: escalate only when P(CRQC before data-retention end) >= 0.25 and exposed traffic is greater than 1.0 TB. 5,008 trials land before the retention end, and exposed traffic is 6.5 TB. Which result follows?

(a) P=0.501; escalate
(b) P=0.501; monitor
(c) P=5.008; escalate
(d) P=0.499; monitor
### Question 17

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant computes a migration start year. The rule is start_by = min(cert_expiry_year - validation_years, CRQC_year - retention_years - migration_years). Current year is 2026. Inputs: cert_expiry=2031, validation=3, CRQC=2034, retention=11, migration=2. Which start year and urgency follow?

(a) 2028; start in future
(b) 2034; start in future
(c) 2023; already late
(d) 2021; already late
### Question 18

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network evaluates side-channel deployment risk for an ARM-class IoT device. The score is 0.35 if the implementation is not constant-time, 0.25 if memory access is secret-dependent, 0.20 if masking is absent, and 0.20 if the device shares an observable power rail. Risk is high for score >=0.70, medium for 0.35-0.69, and low below 0.35. Observed: not_constant_time=False, secret_dependent_memory=True, no_masking=False, shared_power_rail=False. Which score and class follow?

(a) 0.00; low
(b) 0.25; high
(c) 0.25; low
(d) 0.45; medium
### Question 19

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program ranks two cryptographic migration candidates. The Chapter 7 priority formula is priority = HNDL_margin_years*12 + exposed_TB*3 + criticality*8 - migration_cost_thousands. Candidate A has margin=4, exposed_TB=5, criticality=5, cost_thousands=15. Candidate B has priority 78. Which ranking follows?

(a) Candidate A priority -1; B ranks first
(b) Candidate A priority 88; A ranks first
(c) Candidate A priority 88; B ranks first
(d) Candidate A priority 103; A ranks first
### Question 20

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative computes a Chapter 7 quantum migration risk score for an IoT/OT service. The self-contained formula is risk = 0.40*KEX + 0.20*AUTH + 0.15*RETENTION + 0.15*AGILITY + 0.10*SIDE. RETENTION is min(100, retention_years*4). The service has KEX=100, AUTH=80, retention_years=15, AGILITY=20, and SIDE=70. Which score follows?

(a) 75.0
(b) 66.0
(c) No determinate answer can be computed from the stated rule.
(d) 82.0
### Question 21

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site applies Mosca-style Chapter 7 HNDL screening. The rule in this question is: HNDL is active when data_sensitivity_years + migration_years >= years_until_CRQC. The data sensitivity horizon is 26 years, migration takes 2 years, and the CRQC planning horizon is 17 years. Which verdict and margin follow? Margin is sensitivity + migration - CRQC.

(a) not-yet-HNDL-active; margin 11 years
(b) HNDL-active; margin 7 years
(c) HNDL-active; margin -11 years
(d) HNDL-active; margin 11 years
### Question 22

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program reviews symmetric encryption for sensor telemetry. The Chapter 7 rule stated here is: post-Grover effective strength is symmetric_key_bits/2, and long-horizon IoT/OT confidentiality requires at least 128 effective bits. The channel uses AES-192. Which result follows?

(a) 96 effective bits; passes the 128-bit post-Grover floor
(b) 64 effective bits; falls below the 128-bit post-Grover floor
(c) 96 effective bits; falls below the 128-bit post-Grover floor
(d) 192 effective bits; passes the 128-bit post-Grover floor
### Question 23

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority costs a Chapter 7 migration plan. Firmware-updated devices cost $180 each, gateway-proxy devices cost $950 each, VPN-overlay devices cost $420 each, and each validation cohort costs $1,200. Cohorts are ceil(total_devices/25). The plan has 52 firmware devices, 6 proxy devices, and 6 VPN-overlay devices. Which total cost follows?

(a) $94,380
(b) $21,180
(c) $17,580
(d) $56,600
### Question 24

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility classifies TLS services. The local Chapter 7 rule for this question is: RSA key exchange is quantum-vulnerable; ECDHE_RSA and hybrid ECDHE+ML-KEM are transitional; pure ML-KEM key exchange is PQ-ready. The fleet has 5 RSA-key-exchange services, 12 ECDHE_RSA services, 3 hybrid services, and 5 pure ML-KEM services. Which count tuple is correct in the order vulnerable / transitional / PQ-ready?

(a) 5 / 15 / 5
(b) 17 / 3 / 5
(c) 5 / 12 / 8
(d) 0 / 20 / 5
### Question 25

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network measures cryptographic agility for an OT gateway. The score is +35 for TLS 1.3 support, +25 for accepting a hybrid key-share group, +20 for a vendor firmware migration path, and +20 for a tested rollback. Status is agile for score >=70, constrained for 40-69, and blocked for <40. The observed components are TLS1.3=True, hybrid_group=False, vendor_path=False, rollback=False. Which status follows?

(a) score 55; constrained
(b) score 35; agile
(c) score 10; blocked
(d) score 35; blocked
### Question 26

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority runs 10,000 Chapter 7 CRQC timeline trials. The local escalation rule is: escalate only when P(CRQC before data-retention end) >= 0.25 and exposed traffic is greater than 1.0 TB. 3,738 trials land before the retention end, and exposed traffic is 1.5 TB. Which result follows?

(a) P=3.738; escalate
(b) P=0.626; monitor
(c) P=0.374; escalate
(d) P=0.374; monitor
### Question 27

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator computes a migration start year. The rule is start_by = min(cert_expiry_year - validation_years, CRQC_year - retention_years - migration_years). Current year is 2026. Inputs: cert_expiry=2034, validation=1, CRQC=2038, retention=11, migration=4. Which start year and urgency follow?

(a) 2027; start in future
(b) 2023; already late
(c) 2033; start in future
(d) 2035; start in future
### Question 28

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator evaluates side-channel deployment risk for an ARM-class IoT device. The score is 0.35 if the implementation is not constant-time, 0.25 if memory access is secret-dependent, 0.20 if masking is absent, and 0.20 if the device shares an observable power rail. Risk is high for score >=0.70, medium for 0.35-0.69, and low below 0.35. Observed: not_constant_time=False, secret_dependent_memory=False, no_masking=True, shared_power_rail=True. Which score and class follow?

(a) 0.40; medium
(b) 0.60; medium
(c) 0.05; low
(d) 0.40; low
### Question 29

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant ranks two cryptographic migration candidates. The Chapter 7 priority formula is priority = HNDL_margin_years*12 + exposed_TB*3 + criticality*8 - migration_cost_thousands. Candidate A has margin=6, exposed_TB=8, criticality=5, cost_thousands=23. Candidate B has priority 107. Which ranking follows?

(a) Candidate A priority 113; B ranks first
(b) Candidate A priority 136; A ranks first
(c) Candidate A priority -4; B ranks first
(d) Candidate A priority 113; A ranks first
### Question 30

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network computes a Chapter 7 quantum migration risk score for an IoT/OT service. The self-contained formula is risk = 0.40*KEX + 0.20*AUTH + 0.15*RETENTION + 0.15*AGILITY + 0.10*SIDE. RETENTION is min(100, retention_years*4). The service has KEX=30, AUTH=20, retention_years=9, AGILITY=100, and SIDE=25. Which score follows?

(a) 42.2
(b) 41.4
(c) 38.9
(d) 33.5
### Question 31

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program applies Mosca-style Chapter 7 HNDL screening. The rule in this question is: HNDL is active when data_sensitivity_years + migration_years >= years_until_CRQC. The data sensitivity horizon is 22 years, migration takes 2 years, and the CRQC planning horizon is 21 years. Which verdict and margin follow? Margin is sensitivity + migration - CRQC.

(a) HNDL-active; margin -3 years
(b) HNDL-active; margin 3 years
(c) not-yet-HNDL-active; margin 3 years
(d) HNDL-active; margin -1 years
### Question 32

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative reviews symmetric encryption for sensor telemetry. The Chapter 7 rule stated here is: post-Grover effective strength is symmetric_key_bits/2, and long-horizon IoT/OT confidentiality requires at least 128 effective bits. The channel uses AES-256. Which result follows?

(a) 128 effective bits; passes the 128-bit post-Grover floor
(b) 256 effective bits; passes the 128-bit post-Grover floor
(c) 128 effective bits; falls below the 128-bit post-Grover floor
(d) No determinate answer can be computed from the stated rule.
### Question 33

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site costs a Chapter 7 migration plan. Firmware-updated devices cost $180 each, gateway-proxy devices cost $950 each, VPN-overlay devices cost $420 each, and each validation cohort costs $1,200. Cohorts are ceil(total_devices/25). The plan has 36 firmware devices, 6 proxy devices, and 8 VPN-overlay devices. Which total cost follows?

(a) $15,540
(b) $41,040
(c) $75,540
(d) $17,940
### Question 34

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program classifies TLS services. The local Chapter 7 rule for this question is: RSA key exchange is quantum-vulnerable; ECDHE_RSA and hybrid ECDHE+ML-KEM are transitional; pure ML-KEM key exchange is PQ-ready. The fleet has 8 RSA-key-exchange services, 13 ECDHE_RSA services, 7 hybrid services, and 5 pure ML-KEM services. Which count tuple is correct in the order vulnerable / transitional / PQ-ready?

(a) 8 / 13 / 12
(b) 0 / 28 / 5
(c) 8 / 20 / 5
(d) 21 / 7 / 5
### Question 35

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority measures cryptographic agility for an OT gateway. The score is +35 for TLS 1.3 support, +25 for accepting a hybrid key-share group, +20 for a vendor firmware migration path, and +20 for a tested rollback. Status is agile for score >=70, constrained for 40-69, and blocked for <40. The observed components are TLS1.3=True, hybrid_group=True, vendor_path=True, rollback=False. Which status follows?

(a) score 55; constrained
(b) score 80; agile
(c) score 100; agile
(d) score 80; blocked
### Question 36

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility runs 10,000 Chapter 7 CRQC timeline trials. The local escalation rule is: escalate only when P(CRQC before data-retention end) >= 0.25 and exposed traffic is greater than 1.0 TB. 2,468 trials land before the retention end, and exposed traffic is 6.5 TB. Which result follows?

(a) P=0.247; monitor
(b) P=0.247; escalate
(c) P=2.468; escalate
(d) P=0.753; monitor
### Question 37

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network computes a migration start year. The rule is start_by = min(cert_expiry_year - validation_years, CRQC_year - retention_years - migration_years). Current year is 2026. Inputs: cert_expiry=2030, validation=2, CRQC=2034, retention=11, migration=2. Which start year and urgency follow?

(a) 2028; start in future
(b) 2032; start in future
(c) 2023; already late
(d) 2021; already late
### Question 38

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority evaluates side-channel deployment risk for an ARM-class IoT device. The score is 0.35 if the implementation is not constant-time, 0.25 if memory access is secret-dependent, 0.20 if masking is absent, and 0.20 if the device shares an observable power rail. Risk is high for score >=0.70, medium for 0.35-0.69, and low below 0.35. Observed: not_constant_time=False, secret_dependent_memory=True, no_masking=False, shared_power_rail=True. Which score and class follow?

(a) 0.10; low
(b) 0.45; low
(c) 0.45; medium
(d) 0.65; medium
### Question 39

**Scenario provenance only (not needed to answer):** Mirai botnet public research by Antonakakis et al..

A smart-building operator ranks two cryptographic migration candidates. The Chapter 7 priority formula is priority = HNDL_margin_years*12 + exposed_TB*3 + criticality*8 - migration_cost_thousands. Candidate A has margin=8, exposed_TB=2, criticality=5, cost_thousands=10. Candidate B has priority 123. Which ranking follows?

(a) Candidate A priority 5; B ranks first
(b) Candidate A priority 132; A ranks first
(c) Candidate A priority 132; B ranks first
(d) Candidate A priority 142; A ranks first
### Question 40

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A rail signaling operator computes a Chapter 7 quantum migration risk score for an IoT/OT service. The self-contained formula is risk = 0.40*KEX + 0.20*AUTH + 0.15*RETENTION + 0.15*AGILITY + 0.10*SIDE. RETENTION is min(100, retention_years*4). The service has KEX=100, AUTH=80, retention_years=21, AGILITY=65, and SIDE=70. Which score follows?

(a) 85.3
(b) 72.8
(c) 79.8
(d) 92.3
### Question 41

**Scenario provenance only (not needed to answer):** NIST Cybersecurity Framework 2.0.

A food processing plant applies Mosca-style Chapter 7 HNDL screening. The rule in this question is: HNDL is active when data_sensitivity_years + migration_years >= years_until_CRQC. The data sensitivity horizon is 18 years, migration takes 2 years, and the CRQC planning horizon is 9 years. Which verdict and margin follow? Margin is sensitivity + migration - CRQC.

(a) not-yet-HNDL-active; margin 11 years
(b) HNDL-active; margin 7 years
(c) HNDL-active; margin -11 years
(d) HNDL-active; margin 11 years
### Question 42

**Scenario provenance only (not needed to answer):** CISA Known Exploited Vulnerabilities Catalog.

An airport baggage-handling network reviews symmetric encryption for sensor telemetry. The Chapter 7 rule stated here is: post-Grover effective strength is symmetric_key_bits/2, and long-horizon IoT/OT confidentiality requires at least 128 effective bits. The channel uses AES-128. Which result follows?

(a) 64 effective bits; passes the 128-bit post-Grover floor
(b) 0 effective bits; falls below the 128-bit post-Grover floor
(c) 64 effective bits; falls below the 128-bit post-Grover floor
(d) 128 effective bits; passes the 128-bit post-Grover floor
### Question 43

**Scenario provenance only (not needed to answer):** Cui and Stolfo embedded device insecurity research.

A municipal camera program costs a Chapter 7 migration plan. Firmware-updated devices cost $180 each, gateway-proxy devices cost $950 each, VPN-overlay devices cost $420 each, and each validation cohort costs $1,200. Cohorts are ceil(total_devices/25). The plan has 20 firmware devices, 6 proxy devices, and 10 VPN-overlay devices. Which total cost follows?

(a) $56,700
(b) $15,900
(c) $13,500
(d) $26,680
### Question 44

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

An electric cooperative classifies TLS services. The local Chapter 7 rule for this question is: RSA key exchange is quantum-vulnerable; ECDHE_RSA and hybrid ECDHE+ML-KEM are transitional; pure ML-KEM key exchange is PQ-ready. The fleet has 4 RSA-key-exchange services, 14 ECDHE_RSA services, 3 hybrid services, and 5 pure ML-KEM services. Which count tuple is correct in the order vulnerable / transitional / PQ-ready?

(a) 4 / 17 / 5
(b) 18 / 3 / 5
(c) 4 / 14 / 8
(d) 0 / 21 / 5
### Question 45

**Scenario provenance only (not needed to answer):** IEC 62443 industrial automation security standard.

A chemical manufacturing site measures cryptographic agility for an OT gateway. The score is +35 for TLS 1.3 support, +25 for accepting a hybrid key-share group, +20 for a vendor firmware migration path, and +20 for a tested rollback. Status is agile for score >=70, constrained for 40-69, and blocked for <40. The observed components are TLS1.3=True, hybrid_group=False, vendor_path=True, rollback=True. Which status follows?

(a) score 95; agile
(b) score 75; blocked
(c) score 50; constrained
(d) score 75; agile
### Question 46

**Scenario provenance only (not needed to answer):** MITRE ATT&CK public knowledge base.

A university building-automation program runs 10,000 Chapter 7 CRQC timeline trials. The local escalation rule is: escalate only when P(CRQC before data-retention end) >= 0.25 and exposed traffic is greater than 1.0 TB. 1,198 trials land before the retention end, and exposed traffic is 1.5 TB. Which result follows?

(a) P=1.198; escalate
(b) P=0.880; monitor
(c) P=0.120; monitor
(d) P=0.120; escalate
### Question 47

**Scenario provenance only (not needed to answer):** RFC 8446 TLS 1.3 standard.

A regional transit authority computes a migration start year. The rule is start_by = min(cert_expiry_year - validation_years, CRQC_year - retention_years - migration_years). Current year is 2026. Inputs: cert_expiry=2033, validation=3, CRQC=2038, retention=11, migration=4. Which start year and urgency follow?

(a) 2027; start in future
(b) 2023; already late
(c) 2030; start in future
(d) 2036; start in future
### Question 48

**Scenario provenance only (not needed to answer):** CISA AA21-042A on the 2021 U.S. water treatment facility compromise.

A water utility evaluates side-channel deployment risk for an ARM-class IoT device. The score is 0.35 if the implementation is not constant-time, 0.25 if memory access is secret-dependent, 0.20 if masking is absent, and 0.20 if the device shares an observable power rail. Risk is high for score >=0.70, medium for 0.35-0.69, and low below 0.35. Observed: not_constant_time=False, secret_dependent_memory=False, no_masking=False, shared_power_rail=False. Which score and class follow?

(a) 0.00; low
(b) 0.20; low
(c) No determinate answer can be computed from the stated rule.
(d) 0.00; high
### Question 49

**Scenario provenance only (not needed to answer):** NIST SP 800-82 Rev. 3 guidance for operational technology.

A hospital medical-device network ranks two cryptographic migration candidates. The Chapter 7 priority formula is priority = HNDL_margin_years*12 + exposed_TB*3 + criticality*8 - migration_cost_thousands. Candidate A has margin=2, exposed_TB=5, criticality=5, cost_thousands=18. Candidate B has priority 56. Which ranking follows?

(a) Candidate A priority 61; B ranks first
(b) Candidate A priority 79; A ranks first
(c) Candidate A priority -6; B ranks first
(d) Candidate A priority 61; A ranks first
### Question 50

**Scenario provenance only (not needed to answer):** MITRE ATT&CK for ICS public knowledge base.

A maritime port authority computes a Chapter 7 quantum migration risk score for an IoT/OT service. The self-contained formula is risk = 0.40*KEX + 0.20*AUTH + 0.15*RETENTION + 0.15*AGILITY + 0.10*SIDE. RETENTION is min(100, retention_years*4). The service has KEX=30, AUTH=20, retention_years=15, AGILITY=20, and SIDE=25. Which score follows?

(a) 31.0
(b) 33.0
(c) 30.5
(d) 21.5
