Drupal Professional Standards & Competencies 3 — Questions and Answers
Question 1: What is the recommended way for a Drupal professional to stay current with security advisories affecting their client sites?
- Subscribe to the drupal.org security advisories mailing list (Correct answer)
- Check the Drupal homepage weekly
- Wait for hosting provider notifications only
- Monitor only GitHub releases
Correct answer: Subscribe to the drupal.org security advisories mailing list
The official security advisories mailing list delivers timely notices directly, ensuring prompt awareness of vulnerabilities.
Question 2: In a professional Drupal project, who is typically responsible for triaging and resolving security issues flagged by the Drupal Security Team?
- Only Drupal Association staff
- The module or theme maintainer listed on Drupal.org (Correct answer)
- Any community member who finds the issue
- The hosting provider automatically
Correct answer: The module or theme maintainer listed on Drupal.org
The Drupal Security Team works directly with the listed maintainer of the affected project to coordinate a fix and advisory release.
Question 3: Which coding standard does the Drupal community officially use for PHP code style compliance?
- PSR-12 exclusively
- Drupal Coding Standards (based on PSR-2 with Drupal-specific extensions) (Correct answer)
- Google PHP Style Guide
- WordPress PHP Coding Standards
Correct answer: Drupal Coding Standards (based on PSR-2 with Drupal-specific extensions)
Drupal maintains its own coding standards document that extends common PHP conventions with Drupal-specific rules enforced by PHP_CodeSniffer.
Question 4: A Drupal professional is hired to audit a site and discovers the previous developer disabled update notifications. What should they do first?
- Re-enable the Update Manager module and run a status report (Correct answer)
- Immediately update all modules without testing
- Leave the configuration unchanged to avoid disruption
- Delete all contributed modules and reinstall
Correct answer: Re-enable the Update Manager module and run a status report
Re-enabling the Update Manager and reviewing the status report gives a clear picture of outdated or vulnerable components before any action is taken.
Question 5: Which principle should guide a Drupal developer's decision between writing custom code versus using an existing contributed module?
- Always write custom code for full control
- Prefer well-maintained contributed modules to reduce long-term maintenance burden (Correct answer)
- Use contributed modules only if they have more than 10,000 installs
- Never use contributed modules on enterprise projects
Correct answer: Prefer well-maintained contributed modules to reduce long-term maintenance burden
Reusing well-maintained community modules reduces duplication, leverages community security support, and lowers long-term maintenance costs.
Question 6: What does 'dogfooding' mean in the context of the Drupal community?
- Testing modules with synthetic data only
- Using Drupal to build and run Drupal.org itself (Correct answer)
- Feeding log data into a monitoring dashboard
- Running automated regression tests before each release
Correct answer: Using Drupal to build and run Drupal.org itself
Drupal.org itself is built on Drupal, meaning the community 'eats its own dog food' and discovers real-world issues firsthand.
Question 7: When a Drupal professional delivers a project, which documentation artifact is considered a professional best practice for handoff?
- Only the git commit history
- A site-specific runbook covering deployment, cron, backups, and key configuration (Correct answer)
- A full copy of Drupal core documentation
- A single README with the admin password
Correct answer: A site-specific runbook covering deployment, cron, backups, and key configuration
A site-specific runbook gives the next maintainer everything needed to operate, update, and recover the site independently.
Drupal Professional Standards & Competencies 3
What is the recommended way for a Drupal professional to stay current with security advisories affecting their client sites?