Drupal Research & Evidence-Based Practice 4 — Questions and Answers
Question 1: In an evidence-based Drupal security audit, which command-line tool scans for known vulnerabilities in installed modules?
- drush core-status
- drush pm:security (Correct answer)
- drush cache:rebuild
- drush updatedb
Correct answer: drush pm:security
`drush pm:security` checks all installed projects against the Drupal Security Advisories feed and reports any known vulnerable versions.
Question 2: Which practice best supports evidence-based quality assurance when developing a custom Drupal module?
- Writing PHPUnit and Kernel tests that cover critical paths before deployment (Correct answer)
- Manually clicking through the UI once before going live
- Relying on Drupal core tests to cover custom code
- Skipping tests to ship features faster
Correct answer: Writing PHPUnit and Kernel tests that cover critical paths before deployment
Automated PHPUnit and Kernel tests create a reproducible evidence base that custom logic behaves correctly under defined conditions.
Question 3: What role does Drupal's Automated Testing (DTT) framework play in evidence-based development?
- It generates fake content for demos
- It provides a structured harness for functional, kernel, and unit tests that validate behavior objectively (Correct answer)
- It replaces manual code review entirely
- It manages cron job scheduling
Correct answer: It provides a structured harness for functional, kernel, and unit tests that validate behavior objectively
Drupal Testing Traits (DTT) extends PHPUnit to enable functional browser tests, providing objective, repeatable evidence that Drupal sites work as specified.
Question 4: When researching the root cause of a Drupal site performance regression, which log source provides the most direct evidence?
- Drupal's recent log messages (dblog) combined with server-level slow query logs (Correct answer)
- The Drupal.org issue queue for core
- CKEditor's revision history
- The Metatag module configuration page
Correct answer: Drupal's recent log messages (dblog) combined with server-level slow query logs
Combining Drupal's dblog watchdog entries with MySQL/PostgreSQL slow query logs surfaces both application-level errors and database bottlenecks causing regressions.
Question 5: Which Drupal contrib module supports evidence-based editorial workflows by tracking content revision history and authorship?
- Content Moderation (core) (Correct answer)
- Backup and Migrate
- Feeds
- Migrate Plus
Correct answer: Content Moderation (core)
Drupal core's Content Moderation module records revision history, state transitions, and authors, creating an auditable evidence trail for editorial decisions.
Question 6: How should an evidence-based approach guide decisions about Drupal core update timing?
- Update immediately on release day without testing
- Review release notes, test on staging against your specific configuration, then schedule production updates (Correct answer)
- Wait until Drupal's major version is no longer supported before updating
- Update only when users report errors
Correct answer: Review release notes, test on staging against your specific configuration, then schedule production updates
Evidence-based update management requires reviewing changelogs for risk, staging environment validation, and planned rollout to avoid regressions.
Question 7: In Drupal research contexts, what is the primary advantage of using JSON:API over traditional REST exports for data collection?
- JSON:API requires no authentication setup
- JSON:API provides a standardized, filterable, and relationship-aware output ideal for systematic data extraction (Correct answer)
- JSON:API is faster to configure than Views data exports
- JSON:API encrypts all exported data automatically
Correct answer: JSON:API provides a standardized, filterable, and relationship-aware output ideal for systematic data extraction
JSON:API's standardized specification includes filtering, sorting, sparse fieldsets, and relationship inclusion, enabling precise and reproducible data extraction for research.
Drupal Research & Evidence-Based Practice 4
In an evidence-based Drupal security audit, which command-line tool scans for known vulnerabilities in installed modules?