Drupal Risk Assessment & Management 2 — Questions and Answers
Question 1: Which Drupal security team practice helps organizations assess the risk severity of a disclosed vulnerability?
- Publishing a CVSS score with each security advisory (Correct answer)
- Requiring all sites to run automated penetration tests
- Mandating two-factor authentication for all admins
- Blocking all unauthenticated traffic by default
Correct answer: Publishing a CVSS score with each security advisory
Drupal security advisories include a CVSS (Common Vulnerability Scoring System) score so site owners can prioritize patching based on severity.
Question 2: A Drupal site stores sensitive PII in a custom field. Which risk mitigation strategy best protects this data at rest?
- Encrypting field values using the Encrypt module (Correct answer)
- Storing PII only in Drupal's default node title field
- Disabling caching for nodes containing PII
- Setting field permissions to 'authenticated users only'
Correct answer: Encrypting field values using the Encrypt module
The Encrypt module (combined with a key management provider) encrypts field data before it is written to the database.
Question 3: When evaluating a contributed Drupal module for production use, which factor most directly indicates lower security risk?
- The module is covered by Drupal's security advisory policy (Correct answer)
- The module has more than 500 open issues on drupal.org
- The module was last updated three years ago
- The module's README references a custom license
Correct answer: The module is covered by Drupal's security advisory policy
Modules covered by Drupal's security advisory policy are reviewed by the Security Team and receive official patches when vulnerabilities are found.
Question 4: Which Drupal configuration hardening step reduces the risk of an attacker exploiting a compromised admin account?
- Restricting the admin role to the fewest necessary permissions (Correct answer)
- Giving every editor the administrator role for convenience
- Disabling the status report page from Drupal's admin panel
- Setting the site's front page to /user/login
Correct answer: Restricting the admin role to the fewest necessary permissions
Following the principle of least privilege by limiting admin role permissions reduces the blast radius if credentials are compromised.
Question 5: A risk assessment reveals that Drupal's PHP error messages are visible to anonymous visitors. What is the recommended remediation?
- Set 'Error messages to display' to 'None' in production (Correct answer)
- Install a contributed error-display module to beautify messages
- Grant anonymous users the 'view error messages' permission
- Enable Drupal's built-in debug mode for better logging
Correct answer: Set 'Error messages to display' to 'None' in production
Displaying PHP errors to visitors exposes stack traces and file paths; setting error display to 'None' prevents this information leakage.
Question 6: Which tool is commonly used alongside Drupal to perform automated vulnerability scanning as part of a continuous risk management process?
- Drupalgeddon scanner or OWASP ZAP (Correct answer)
- Drupal's built-in Views query inspector
- The Drupal migrate module
- PHP's native var_dump() function
Correct answer: Drupalgeddon scanner or OWASP ZAP
Tools like Drupalgeddon scanners or OWASP ZAP perform automated vulnerability checks against Drupal installations as part of ongoing risk management.
Question 7: An organization's risk register lists 'outdated Drupal core' as a high-severity risk. Which control directly reduces the likelihood of this risk being exploited?
- Establishing a monthly patch management cycle for Drupal core (Correct answer)
- Archiving all content before the next Drupal update
- Migrating all content to a headless CMS immediately
- Increasing server RAM to handle more concurrent requests
Correct answer: Establishing a monthly patch management cycle for Drupal core
A regular patch management cycle ensures core security releases are applied promptly, directly reducing the window of exposure to known vulnerabilities.
Drupal Risk Assessment & Management 2
Which Drupal security team practice helps organizations assess the risk severity of a disclosed vulnerability?