Drupal Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Which Drupal module is commonly used to implement cookie consent banners required by GDPR and ePrivacy regulations?
- EU Cookie Compliance (Correct answer)
- Cookie Policy
- GDPR Shield
- Privacy Banner
Correct answer: EU Cookie Compliance
The EU Cookie Compliance module provides configurable cookie consent banners that satisfy GDPR and ePrivacy Directive requirements.
Question 2: Under HIPAA, which type of Drupal data at rest containing Protected Health Information (PHI) requires encryption?
- Only database records
- Only uploaded files
- Both database records and file system storage (Correct answer)
- Only cached data
Correct answer: Both database records and file system storage
HIPAA requires encryption of all PHI at rest, which in Drupal includes both the database and the public/private file system.
Question 3: Which Drupal core feature helps satisfy ADA Section 508 accessibility compliance by providing alt text fields for images?
- Media Library
- Image field with required alt text setting (Correct answer)
- File field
- Responsive Image module
Correct answer: Image field with required alt text setting
Drupal's Image field has a configurable 'Required alt text' setting that enforces content editors to supply alt text, meeting Section 508 requirements.
Question 4: A Drupal site serving EU users must honor a user's 'right to erasure' under GDPR. Which module provides automated personal data deletion workflows?
- Data Policy
- GDPR Compliance (Correct answer)
- Personal Data Erasure
- Right to be Forgotten
Correct answer: GDPR Compliance
The GDPR Compliance module provides tools for managing data erasure requests and automating personal data removal workflows.
Question 5: For PCI DSS compliance on a Drupal e-commerce site, which practice is essential when handling cardholder data in forms?
- Store card numbers in the Drupal database encrypted
- Never store or transmit raw card numbers through Drupal; use tokenization via a payment gateway (Correct answer)
- Log all card transactions in watchdog
- Use Drupal's built-in encryption API to store card numbers
Correct answer: Never store or transmit raw card numbers through Drupal; use tokenization via a payment gateway
PCI DSS requires that raw cardholder data never passes through your server; tokenization via a compliant payment gateway keeps Drupal out of scope.
Question 6: Which Drupal configuration helps comply with NIST SP 800-63 password guidelines by enforcing complexity and length requirements?
- Password Policy module (Correct answer)
- User module account settings
- Security Review module
- Shield module
Correct answer: Password Policy module
The Password Policy module enforces configurable rules such as minimum length, character classes, and history checks aligned with NIST guidelines.
Question 7: Under COPPA, a Drupal site targeting users in the US must prevent children under what age from registering without verifiable parental consent?
- 13 (Correct answer)
- 16
- 18
- 12
Correct answer: 13
COPPA (Children's Online Privacy Protection Act) applies to children under 13 and requires verifiable parental consent before collecting their personal information.
Drupal Regulatory Frameworks & Compliance 2
Which Drupal module is commonly used to implement cookie consent banners required by GDPR and ePrivacy regulations?