Risk Assessment & Management Flashcards

Which practice reduces the risk of a supply-chain attack via Drupal's contributed module ecosystem?

Answer: Using Composer with a composer.lock file and verifying package hashes

Composer's lock file pins exact package versions and checksums, making it harder for tampered packages to be silently introduced.

A Drupal site's risk assessment notes that database credentials are stored in settings.php inside the web root. What is the best remediation?

Answer: Move settings.php outside the web root or use environment variables for credentials

Moving settings.php outside the web root or using environment variables ensures credentials are never directly accessible via HTTP even if directory listing is misconfigured.

Which Drupal logging feature supports risk management by providing an audit trail of administrative actions?

Answer: The Database Logging (dblog) module combined with the Syslog module for off-server storage

Combining dblog with Syslog (or a SIEM integration) creates a tamper-resistant audit trail of admin actions stored off the compromised server.

An organization accepts the risk of running an end-of-life Drupal version on an isolated internal tool. Which risk management strategy does this represent?

Answer: Risk acceptance with documented justification

Consciously deciding to tolerate a known risk with formal documentation is the definition of risk acceptance.

Which Drupal permission represents a critical risk if granted to untrusted roles?

Answer: 'Use PHP for settings' or 'Administer software updates'

Permissions that allow PHP execution or software updates give a role the ability to run arbitrary code or introduce vulnerable modules.

A risk analysis shows that a Drupal site's session cookie lacks the Secure flag. What attack does this enable?

Answer: Session hijacking over unencrypted HTTP connections

Without the Secure flag, session cookies are transmitted over plain HTTP, allowing network attackers to capture and reuse them.

Which risk is introduced by enabling Drupal's PHP filter module on a production site?

Answer: Content editors can embed executable PHP code directly in nodes, enabling remote code execution

The PHP filter module allows users with the right permission to insert and execute PHP within content, creating a severe remote code execution risk.