Drupal Case Studies & Practical Application 4 — Questions and Answers
Question 1: A Drupal 10 site must expose content to a React frontend via JSON:API. An endpoint returns 403 for authenticated users on a specific content type. What should you check first?
- JSON:API module version compatibility
- The content type's 'View published content' permission for the user's role (Correct answer)
- CORS settings in services.yml
- The React app's Authorization header format
Correct answer: The content type's 'View published content' permission for the user's role
JSON:API respects Drupal's node access system; if authenticated users get 403, the role is missing the 'View published content' permission for that content type.
Question 2: A client running Drupal 9 must urgently apply a security advisory. The fix is available only in Drupal 10. What is the correct order of operations?
- Apply any available Drupal 9 patch first, then plan the Drupal 10 upgrade (Correct answer)
- Immediately upgrade the database schema to Drupal 10 in production
- Disable the affected module until a Drupal 9 patch is released
- Fork the module and backport the fix manually as a temporary measure
Correct answer: Apply any available Drupal 9 patch first, then plan the Drupal 10 upgrade
Check for any available Drupal 9-compatible patch or release first; if none exists, applying a manual backport and then scheduling the major version upgrade is the responsible path.
Question 3: An agency builds a Drupal distribution (install profile) for clients. Clients report that running `drush config-import` overwrites customizations they made post-install. What is the root cause?
- Install profiles lock configuration so clients cannot override it
- The distribution exports config with the profile's machine name embedded, causing conflicts
- drush config-import always resets to the original install profile configuration
- Clients must use config_split to manage environment-specific overrides (Correct answer)
Correct answer: Clients must use config_split to manage environment-specific overrides
Config Split allows separating environment-specific or client-specific configuration from the shared base configuration, preventing client customizations from being overwritten during imports.
Question 4: A multilingual Drupal site serves English and Spanish. The SEO team finds Spanish pages are not indexed because hreflang tags are missing. What module generates hreflang tags in Drupal core?
- Language module generates hreflang via the HTML head
- Content Translation module adds hreflang automatically when translations exist (Correct answer)
- Metatag module with the hreflang submodule
- Pathauto with language-prefix settings
Correct answer: Content Translation module adds hreflang automatically when translations exist
Drupal core's Content Translation module automatically outputs hreflang link elements in the HTML head for each available translation of a node.
Question 5: A media agency needs video files transcoded to multiple formats after upload in Drupal. Which approach best fits this requirement?
- Use the Media module with a custom transcoding hook that calls FFmpeg directly on upload
- Integrate a cloud transcoding service via a queue worker triggered on media entity save (Correct answer)
- Store original files only and use a browser-side video.js transcoder
- Enable Drupal's built-in video optimization setting in the File module
Correct answer: Integrate a cloud transcoding service via a queue worker triggered on media entity save
Triggering a queue worker that calls a cloud transcoding API (e.g., Mux, Transloadit) on media entity save offloads CPU-intensive work and scales reliably.
Question 6: A Drupal site's contact form is receiving hundreds of spam submissions per day despite CAPTCHA. Which additional server-side Drupal measure is most effective?
- Honeypot module adding a hidden field that bots fill but humans ignore (Correct answer)
- Increasing CAPTCHA difficulty level to audio-only
- Disabling the contact form for anonymous users
- Adding a JavaScript delay before form submission is allowed
Correct answer: Honeypot module adding a hidden field that bots fill but humans ignore
The Honeypot module adds a hidden field and a time-limit check that block most automated spam without degrading UX for real users.
Question 7: A Drupal developer is asked to display a block only on the /about and /contact pages. What is the Drupal admin UI approach without writing code?
- Set the block's visibility to 'Specific pages' and list /about and /contact in the pages field (Correct answer)
- Create a custom block plugin with a path-matching condition
- Use the Context module to define path-based block placement rules
- Edit the block's twig template to add a path check
Correct answer: Set the block's visibility to 'Specific pages' and list /about and /contact in the pages field
In Block Layout, each block has a 'Pages' visibility condition where you can list specific paths to restrict where the block appears.
Drupal Case Studies & Practical Application 4
A Drupal 10 site must expose content to a React frontend via JSON:API.
An endpoint returns 403 for authenticated users on a specific content type.
What should you check first?