Drupal Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which Drupal module provides role-based access control (RBAC) audit reports, helping demonstrate least-privilege compliance to auditors?
- Permission Grid
- Role Delegation
- Permissions Report (Correct answer)
- Access Policy
Correct answer: Permissions Report
The Permissions Report module generates exportable reports of all permissions assigned per role, providing documentation for least-privilege compliance audits.
Question 2: For a Drupal site processing financial transactions, which PCI DSS requirement mandates that all transmitted cardholder data be encrypted with strong cryptography?
- Requirement 3
- Requirement 4 (Correct answer)
- Requirement 6
- Requirement 10
Correct answer: Requirement 4
PCI DSS Requirement 4 mandates encryption of cardholder data transmitted over open, public networks using strong cryptography (e.g., TLS 1.2+).
Question 3: A Drupal site must implement Content Security Policy (CSP) headers to comply with security standards. Where is this best configured?
- In Drupal's theme layer
- In the web server (Apache/Nginx) configuration or via the Security Headers module (Correct answer)
- In settings.php using $config
- In the .htaccess file's HTML meta tags
Correct answer: In the web server (Apache/Nginx) configuration or via the Security Headers module
CSP headers are best set at the web server level (Apache/Nginx) or using the Security Headers module, ensuring they apply to all responses before the application layer.
Question 4: Under GDPR's 'Privacy by Design' principle (Article 25), when must data protection considerations be addressed in Drupal development?
- After the site launches based on user feedback
- During the design and build phase, before deployment (Correct answer)
- Only when a data breach occurs
- When requested by a data protection officer
Correct answer: During the design and build phase, before deployment
Privacy by Design requires data protection to be built into systems from the outset of design and development, not retrofitted after deployment.
Question 5: Which Drupal feature supports HIPAA's requirement for unique user identification by preventing shared user accounts?
- Drupal's one-account-per-email enforcement (Correct answer)
- The Masquerade module
- Single Sign-On (SSO) integration
- The Bakery module
Correct answer: Drupal's one-account-per-email enforcement
Drupal enforces unique email addresses per account by default, ensuring each user has a unique, identifiable account as HIPAA's unique user identification requirement demands.
Question 6: Which Drupal administrative practice satisfies the 'media sanitization' control in NIST SP 800-53 when decommissioning a Drupal server?
- Deleting the Drupal database user
- Running 'drush sql-drop' to remove tables
- Securely wiping or destroying storage media containing Drupal's database and files (Correct answer)
- Disabling all Drupal user accounts before shutdown
Correct answer: Securely wiping or destroying storage media containing Drupal's database and files
NIST SP 800-53 MP-6 (Media Sanitization) requires secure wiping or physical destruction of storage media to prevent data recovery from decommissioned hardware.
Question 7: A Drupal site must display a GDPR-compliant cookie notice that does not use 'pre-ticked' consent boxes. What does this mean technically?
- Cookies must be opt-out, not opt-in
- Non-essential cookies must be disabled by default until the user actively gives consent (Correct answer)
- Cookie notices must appear only on the homepage
- Analytics cookies require a separate consent form
Correct answer: Non-essential cookies must be disabled by default until the user actively gives consent
GDPR requires freely given, specific, informed, and unambiguous consent — non-essential cookies must be off by default, with consent obtained before they fire.
Drupal Regulatory Frameworks & Compliance 5
Which Drupal module provides role-based access control (RBAC) audit reports, helping demonstrate least-privilege compliance to auditors?