Drupal Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Which Drupal module helps site owners create and display a GDPR-compliant privacy policy with version tracking and user acceptance logging?
- Legal (Correct answer)
- Privacy Policy
- Terms & Conditions
- Consent Manager
Correct answer: Legal
The Legal module displays terms and privacy policies at registration, tracks versions, and logs user acceptance timestamps for compliance auditing.
Question 2: A government Drupal site must comply with FISMA. Which security framework does FISMA mandate federal agencies use for risk management?
- ISO 27001
- NIST Risk Management Framework (RMF) (Correct answer)
- CIS Controls
- SOC 2 Type II
Correct answer: NIST Risk Management Framework (RMF)
FISMA requires federal agencies to implement the NIST Risk Management Framework for categorizing, selecting, implementing, and assessing security controls.
Question 3: Which Drupal configuration option prevents sensitive data from appearing in log outputs, helping meet compliance requirements around data minimization?
- Disabling the Database Logging module
- Configuring the 'sanitize' flag in settings.php (Correct answer)
- Using the Masquerade module
- Enabling Syslog instead of DBLog
Correct answer: Configuring the 'sanitize' flag in settings.php
Setting sanitize options in settings.php (e.g., for Drush) strips passwords and sensitive fields from logs, supporting data minimization requirements.
Question 4: For SOC 2 Type II compliance, which Drupal logging capability is most relevant to satisfying the 'Availability' trust service criterion?
- Watchdog error logs showing uptime incidents (Correct answer)
- User login audit trails
- File access logs
- Content revision history
Correct answer: Watchdog error logs showing uptime incidents
SOC 2 Availability requires evidence of uptime monitoring and incident response; Drupal's watchdog error logs document system availability events.
Question 5: Which Drupal module allows administrators to define and enforce content moderation workflows that create an audit trail for regulatory compliance?
- Workbench Moderation
- Content Moderation (core) (Correct answer)
- Scheduler
- Flag
Correct answer: Content Moderation (core)
Drupal core's Content Moderation module provides state-machine workflows with revision tracking, creating an auditable history of content changes.
Question 6: A healthcare Drupal site must implement automatic session timeout to comply with HIPAA's access control requirements. Which setting controls this?
- PHP session.gc_maxlifetime
- Drupal's 'Automatic logout' module
- Both session.gc_maxlifetime and the Automatic Logout module configured together (Correct answer)
- User account password expiry settings
Correct answer: Both session.gc_maxlifetime and the Automatic Logout module configured together
HIPAA-compliant session timeout requires both PHP's session garbage collection and an application-layer module like Automatic Logout working together.
Question 7: Under GDPR's data portability requirement (Article 20), what should a Drupal site provide to users upon request?
- A PDF printout of their profile page
- Their personal data in a structured, machine-readable format (Correct answer)
- A summary email of account activity
- Read-only access to their account for 30 days
Correct answer: Their personal data in a structured, machine-readable format
GDPR Article 20 requires providing personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) so users can transfer it.
Drupal Regulatory Frameworks & Compliance 3
Which Drupal module helps site owners create and display a GDPR-compliant privacy policy with version tracking and user acceptance logging?