Risk Assessment & Management Flashcards

Which approach best supports ongoing risk management for a large Drupal multisite installation?

Answer: Centralizing Drupal core and contributed modules via Composer with a shared codebase and per-site settings

A shared codebase managed by Composer means security patches are applied once and inherited by all sites, reducing the risk surface across the entire installation.

A Drupal site receives a high-severity security advisory for a module it uses. According to risk management best practices, what should happen first?

Answer: Assess whether the vulnerable functionality is reachable by potential attackers on this specific site

Context-specific impact assessment determines actual exploitability before committing to an emergency change that could cause downtime.

Which Drupal mechanism reduces the risk of cross-site request forgery (CSRF) attacks on state-changing operations?

Answer: Drupal's form API automatically generates and validates unique form tokens

Drupal's Form API includes built-in CSRF tokens (form_token and form_build_id) that are validated on submission, preventing cross-site request forgery.

What risk does running Drupal with PHP's 'register_globals' enabled (on legacy PHP versions) introduce?

Answer: Attackers can inject arbitrary variables via URL parameters, potentially overwriting Drupal's internal variables

register_globals allows external input to populate PHP variables, enabling attackers to overwrite security-relevant variables in Drupal's codebase.

A risk assessment flags that Drupal's cron is running publicly accessible at /cron/{key} without HTTPS. What is the primary concern?

Answer: The cron key can be intercepted and used to trigger cron jobs or enumerate system tasks

The cron key transmitted over plain HTTP can be sniffed by a network observer, who could then trigger cron execution or map system tasks.

Which configuration change reduces the risk of brute-force attacks on Drupal login?

Answer: Installing the Flood Control or Login Security module to limit failed login attempts

Flood Control and Login Security modules impose attempt limits and lockouts, directly countering brute-force credential attacks.

An organization runs a risk assessment and determines that a third-party CDN handles DDoS mitigation for their Drupal site. Which risk management strategy is this?

Answer: Risk transference — shifting DDoS impact responsibility to the CDN provider

Using a third-party CDN for DDoS protection transfers the operational burden and financial impact of that risk to the provider.