Drupal Drupal Performance & Security 2

Question 1

What is the primary mechanism Drupal's Database API uses to prevent SQL injection attacks?

Accepted Answer

Prepared statements that separate SQL structure from user-supplied data

Answer

Regular expression validation on all user input before database operations

Answer

Escaping query strings with PHP's htmlspecialchars() function

Answer

Whitelisting allowed characters in all form field values

Question 2

Which Drupal utility class should developers use to sanitize user-supplied text before rendering it in HTML to prevent XSS?

Accepted Answer

Drupal's Xss::filter() or Html::escape() from the Drupal\Component\Utility namespace

Answer

PHP's built-in strip_tags() function

Answer

PHP's built-in htmlspecialchars() function

Answer

WordPress's sanitize_text_field() ported to Drupal

Question 3

What attack does the 'trusted_host_patterns' setting in Drupal's settings.php guard against?

Accepted Answer

HTTP Host header injection that can enable cache poisoning or manipulated password reset links

Answer

SQL injection via crafted hostname values

Answer

Cross-site request forgery via the referer header

Answer

Brute-force login attacks from specific IP ranges

Question 4

How does Drupal's Form API automatically protect against Cross-Site Request Forgery (CSRF)?

Accepted Answer

It adds a unique token to every form and validates it on submission

Answer

It requires all forms to be submitted over HTTPS only

Answer

It limits form submissions to users who have been active within the last 30 minutes

Answer

It encrypts all form field values with a session-specific key

Question 5

What is the purpose of Drupal Security Advisories labeled 'SA-CORE'?

Accepted Answer

Officially disclosing and providing patches for security vulnerabilities found in Drupal core

Answer

Announcing major new features added to Drupal core releases

Answer

Rating the overall security posture of specific Drupal site configurations

Answer

Publishing developer best practices from the Drupal Association

Question 6

What is the primary function of Drupal's Update Manager module from a security perspective?

Accepted Answer

It checks drupal.org for available updates and alerts administrators when security releases are available

Answer

It automatically downloads and applies security patches without administrator action

Answer

It enforces mandatory updates by blocking site access until patches are applied

Answer

It scans installed modules for known vulnerable code patterns

Question 7

What does the principle of 'least privilege' mean when assigning Drupal user roles?

Accepted Answer

Users should receive only the minimum permissions required to perform their assigned tasks

Answer

Anonymous users must always have fewer permissions than authenticated users

Answer

Administrators should create separate accounts for privileged versus routine operations

Answer

New users should start with no permissions and formally request access upgrades