Drupal Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Which Drupal security practice is required by the OWASP Top 10 to prevent injection attacks in custom database queries?
- Using db_query() with raw SQL strings
- Using Drupal's database abstraction layer with parameterized queries (Correct answer)
- Sanitizing output with check_plain()
- Enabling the Security Review module
Correct answer: Using Drupal's database abstraction layer with parameterized queries
Drupal's database API uses parameterized queries (placeholders) that prevent SQL injection, directly addressing the OWASP A03:2021 Injection risk.
Question 2: A Drupal site must comply with California Consumer Privacy Act (CCPA). Which user right does CCPA grant that requires a 'Do Not Sell My Personal Information' link?
- Right to erasure
- Right to opt out of the sale of personal information (Correct answer)
- Right to data portability
- Right to correct inaccurate data
Correct answer: Right to opt out of the sale of personal information
CCPA grants California residents the right to opt out of the sale of their personal information, requiring a conspicuous 'Do Not Sell My Personal Information' link.
Question 3: For FedRAMP authorization, a Drupal application must be hosted in an environment certified to which standard?
- PCI DSS Level 1
- NIST SP 800-53 controls at the appropriate impact level (Correct answer)
- ISO 27001 certification
- SOC 2 Type II
Correct answer: NIST SP 800-53 controls at the appropriate impact level
FedRAMP requires cloud systems hosting federal data to implement NIST SP 800-53 security controls at Low, Moderate, or High impact level.
Question 4: Which Drupal module helps meet WCAG 2.1 AA accessibility standards by automatically checking content for accessibility issues before publishing?
- Editoria11y (Correct answer)
- Accessibility Checker
- axe Accessibility
- Checkup
Correct answer: Editoria11y
Editoria11y (Editorial Accessibility) scans Drupal content in real-time and alerts editors to accessibility issues before content is published.
Question 5: Under the EU's General Data Protection Regulation, what is the maximum time limit for notifying a supervisory authority of a personal data breach?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
Question 6: Which Drupal configuration prevents cross-site request forgery (CSRF) attacks, a requirement for compliance with OWASP and many regulatory frameworks?
- HTTPS enforcement via settings.php
- Form API tokens (form_token) included automatically in all forms (Correct answer)
- Content Security Policy headers
- The Shield module
Correct answer: Form API tokens (form_token) included automatically in all forms
Drupal's Form API automatically adds a unique form_token to every form, validating it on submission to prevent CSRF attacks.
Question 7: A multinational Drupal site must comply with data residency requirements, keeping EU user data within the EU. Which infrastructure consideration is primary?
- Using a CDN with EU edge nodes
- Hosting the Drupal database and file storage in EU-based data centers (Correct answer)
- Setting the site's timezone to a European timezone
- Using HTTPS with EU-issued certificates
Correct answer: Hosting the Drupal database and file storage in EU-based data centers
Data residency requires that the actual database and file storage containing personal data physically reside within EU data centers, not just CDN caching.
Drupal Regulatory Frameworks & Compliance 4
Which Drupal security practice is required by the OWASP Top 10 to prevent injection attacks in custom database queries?