Drupal Professional Standards & Competencies 2 — Questions and Answers
Question 1: Which Drupal community resource serves as the primary hub for reporting security vulnerabilities in contributed modules?
- drupal.org/security (Correct answer)
- github.com/drupal
- drupal.stackexchange.com
- groups.drupal.org
Correct answer: drupal.org/security
The Drupal Security Team publishes all advisories and accepts vulnerability reports at drupal.org/security.
Question 2: A client asks you to keep their Drupal site on an end-of-life core version to avoid migration costs. What is the professionally appropriate response?
- Comply since the client pays the bills
- Document the risk in writing and strongly recommend upgrading (Correct answer)
- Refuse the engagement entirely
- Silently upgrade without telling the client
Correct answer: Document the risk in writing and strongly recommend upgrading
Documenting risks in writing protects both parties and upholds professional duty to inform the client of security exposure.
Question 3: What does the Drupal Certified Developer exam primarily validate?
- Ability to write custom Drupal themes from scratch
- Core competency in Drupal site building, module development, and best practices (Correct answer)
- Mastery of a specific third-party hosting platform
- Proficiency in only the latest Drupal major version
Correct answer: Core competency in Drupal site building, module development, and best practices
The Drupal Certified Developer credential tests broad core competencies including site building, module development, and adherence to best practices.
Question 4: When contributing a new module to Drupal.org, which license must your code use?
- MIT
- Apache 2.0
- GPL-2.0-or-later (Correct answer)
- Creative Commons BY
Correct answer: GPL-2.0-or-later
All code hosted on Drupal.org must be licensed under GPL-2.0-or-later to maintain Drupal's open-source license compatibility.
Question 5: Which practice best demonstrates a Drupal developer's commitment to backward compatibility when releasing a module update?
- Renaming all hooks without an alias
- Incrementing the major version for any API change and following semantic versioning (Correct answer)
- Removing deprecated functions immediately
- Avoiding all API changes indefinitely
Correct answer: Incrementing the major version for any API change and following semantic versioning
Following semantic versioning and incrementing the major version signals breaking changes, allowing site owners to test before upgrading.
Question 6: A team member suggests storing an API key directly in a custom module's PHP file committed to Git. What is the correct professional response?
- Accept it if the repository is private
- Reject it; store secrets in environment variables or the settings.php file excluded from version control (Correct answer)
- Allow it only for staging environments
- Encrypt the file before committing
Correct answer: Reject it; store secrets in environment variables or the settings.php file excluded from version control
Secrets must never be committed to version control; environment variables or untracked settings files are the proper approach.
Question 7: Which Drupal.org issue queue status indicates that a patch is ready for a project maintainer to review and commit?
- Needs work
- Active
- Needs review (Correct answer)
- Postponed
Correct answer: Needs review
'Needs review' signals that a patch or merge request is ready for maintainer evaluation and potential commit.
Drupal Professional Standards & Competencies 2
Which Drupal community resource serves as the primary hub for reporting security vulnerabilities in contributed modules?