Drupal Risk Assessment & Management 2

Question 1

Which Drupal security team practice helps organizations assess the risk severity of a disclosed vulnerability?

Accepted Answer

Publishing a CVSS score with each security advisory

Answer

Drupal security advisories include a CVSS (Common Vulnerability Scoring System) score so site owners can prioritize patching based on severity.

Question 2

A Drupal site stores sensitive PII in a custom field. Which risk mitigation strategy best protects this data at rest?

Accepted Answer

Encrypting field values using the Encrypt module

Answer

The Encrypt module (combined with a key management provider) encrypts field data before it is written to the database.

Question 3

When evaluating a contributed Drupal module for production use, which factor most directly indicates lower security risk?

Accepted Answer

The module is covered by Drupal's security advisory policy

Answer

Modules covered by Drupal's security advisory policy are reviewed by the Security Team and receive official patches when vulnerabilities are found.

Question 4

Which Drupal configuration hardening step reduces the risk of an attacker exploiting a compromised admin account?

Accepted Answer

Restricting the admin role to the fewest necessary permissions

Answer

Following the principle of least privilege by limiting admin role permissions reduces the blast radius if credentials are compromised.

Question 5

A risk assessment reveals that Drupal's PHP error messages are visible to anonymous visitors. What is the recommended remediation?

Accepted Answer

Set 'Error messages to display' to 'None' in production

Answer

Displaying PHP errors to visitors exposes stack traces and file paths; setting error display to 'None' prevents this information leakage.

Drupal Practice Test