Risk Assessment & Management Flashcards

Which Drupal feature helps assess the risk exposure of a site's configuration by comparing current settings against known best practices?

Answer: The Security Review module

The Security Review module automatically checks Drupal configuration against common security best practices and reports risks.

A risk assessment identifies that anonymous users can access Drupal's /admin path. What is the correct mitigation?

Answer: Restrict admin paths using Drupal's permission system and optionally an HTTP authentication layer

Combining Drupal's role-based access control with an additional HTTP authentication layer (e.g., at the web server level) provides defense-in-depth for admin paths.

Which risk does the Drupal 'Trusted Host Settings' configuration ($settings['trusted_host_patterns']) directly mitigate?

Answer: HTTP Host header injection attacks

Trusted host patterns prevent attackers from injecting malicious Host headers that could be used in cache poisoning or password reset link attacks.

During a Drupal risk review, a site is found to allow file uploads with no extension restrictions. Which module helps mitigate this risk?

Answer: Configuring the allowed file extensions list in each file field's settings

Restricting allowed file extensions in each file/image field's configuration is the primary control preventing dangerous file type uploads.

What risk is introduced when Drupal's update.php is left accessible without authentication after a site update?

Answer: Any visitor could run database updates and potentially corrupt data or escalate privileges

An unauthenticated update.php allows anyone to trigger database schema changes, risking data corruption, denial of service, or privilege escalation.

Which risk management concept is applied when a Drupal site keeps a tested rollback snapshot before every major update?

Answer: Risk mitigation through contingency planning

Maintaining rollback snapshots is a contingency planning control that mitigates the impact of a failed update.

A penetration test reveals that Drupal's private file system path is inside the web root. What risk does this create?

Answer: Private files become directly downloadable via URL without Drupal's access checks

Placing the private file directory inside the web root allows direct URL access, bypassing Drupal's access control layer entirely.