Drupal Professional Standards & Competencies 4 — Questions and Answers
Question 1: Which tool do Drupal developers use to enforce coding standards automatically during development?
- Composer
- PHP_CodeSniffer with the Drupal ruleset (Correct answer)
- Drush
- Xdebug
Correct answer: PHP_CodeSniffer with the Drupal ruleset
PHP_CodeSniffer with the Drupal and DrupalPractice sniff sets automatically detects coding standard violations in Drupal projects.
Question 2: A project manager requests a feature that requires bypassing Drupal's entity access API. What is the professionally correct action?
- Implement it as requested to meet the deadline
- Explain the security implications and propose an access-compliant alternative (Correct answer)
- Use hook_node_access() to quietly reduce restrictions
- Skip the feature and say it's impossible
Correct answer: Explain the security implications and propose an access-compliant alternative
Bypassing Drupal's entity access system creates privilege escalation risks; a professional must communicate this and offer a compliant design.
Question 3: What is the purpose of the Drupal Rector tool in a professional workflow?
- Managing Composer dependencies
- Automatically refactoring deprecated Drupal API calls to their modern equivalents (Correct answer)
- Generating test fixtures
- Running performance benchmarks
Correct answer: Automatically refactoring deprecated Drupal API calls to their modern equivalents
Drupal Rector uses PHP-Parser rules to automatically update deprecated API usage, easing major version upgrades.
Question 4: Which approach to configuration management is considered a Drupal best practice on professional projects?
- Making all changes directly in the production database
- Using Drupal's Configuration Management Initiative (CMI) to export config to YAML files tracked in version control (Correct answer)
- Storing config in a spreadsheet shared with the client
- Relying solely on Features module exports
Correct answer: Using Drupal's Configuration Management Initiative (CMI) to export config to YAML files tracked in version control
CMI YAML exports in version control enable reproducible deployments, peer review of configuration changes, and rollback capability.
Question 5: A Drupal developer discovers a security vulnerability in a widely-used contrib module. What is the responsible disclosure process?
- Post the vulnerability details publicly on Twitter immediately
- Report it privately to the Drupal Security Team via the designated contact form (Correct answer)
- Open a public issue in the module's queue
- Fix it in a fork and release without notifying the maintainer
Correct answer: Report it privately to the Drupal Security Team via the designated contact form
Responsible disclosure requires private reporting to the Drupal Security Team, who coordinate a fix and coordinated public release with the maintainer.
Question 6: Which practice ensures that a Drupal site's update path is properly validated before deploying to production?
- Running updates directly on production with a database backup ready
- Executing hook_update_N() functions in a staging environment first (Correct answer)
- Skipping update hooks and importing a fresh config export
- Disabling maintenance mode during updates for speed
Correct answer: Executing hook_update_N() functions in a staging environment first
Testing update hooks on a staging clone of production data catches data migration errors before they affect real users.
Question 7: In terms of professional competency, what does 'DX' stand for in Drupal developer discussions?
- Data Exchange
- Developer Experience (Correct answer)
- Drupal Extensions
- Dependency eXecution
Correct answer: Developer Experience
DX (Developer Experience) refers to how easy and pleasant it is for developers to work with Drupal's APIs, tooling, and documentation.
Drupal Professional Standards & Competencies 4
Which tool do Drupal developers use to enforce coding standards automatically during development?