Drupal Regulatory Frameworks & Compliance 5

Question 1

Which Drupal module provides role-based access control (RBAC) audit reports, helping demonstrate least-privilege compliance to auditors?

Accepted Answer

Permissions Report

Answer

The Permissions Report module generates exportable reports of all permissions assigned per role, providing documentation for least-privilege compliance audits.

Question 2

For a Drupal site processing financial transactions, which PCI DSS requirement mandates that all transmitted cardholder data be encrypted with strong cryptography?

Accepted Answer

Requirement 4

Answer

PCI DSS Requirement 4 mandates encryption of cardholder data transmitted over open, public networks using strong cryptography (e.g., TLS 1.2+).

Question 3

A Drupal site must implement Content Security Policy (CSP) headers to comply with security standards. Where is this best configured?

Accepted Answer

In the web server (Apache/Nginx) configuration or via the Security Headers module

Answer

CSP headers are best set at the web server level (Apache/Nginx) or using the Security Headers module, ensuring they apply to all responses before the application layer.

Question 4

Under GDPR's 'Privacy by Design' principle (Article 25), when must data protection considerations be addressed in Drupal development?

Accepted Answer

During the design and build phase, before deployment

Answer

Privacy by Design requires data protection to be built into systems from the outset of design and development, not retrofitted after deployment.

Question 5

Which Drupal feature supports HIPAA's requirement for unique user identification by preventing shared user accounts?

Accepted Answer

Drupal's one-account-per-email enforcement

Answer

Drupal enforces unique email addresses per account by default, ensuring each user has a unique, identifiable account as HIPAA's unique user identification requirement demands.

Drupal Practice Test

Drupal Practice Test

Drupal Regulatory Frameworks & Compliance 5