Drupal Risk Assessment & Management 3 — Questions and Answers
Question 1: Which Drupal feature helps assess the risk exposure of a site's configuration by comparing current settings against known best practices?
- The Security Review module (Correct answer)
- The Aggregator module
- The Statistics module
- The Tour module
Correct answer: The Security Review module
The Security Review module automatically checks Drupal configuration against common security best practices and reports risks.
Question 2: A risk assessment identifies that anonymous users can access Drupal's /admin path. What is the correct mitigation?
- Restrict admin paths using Drupal's permission system and optionally an HTTP authentication layer (Correct answer)
- Create a redirect rule sending all /admin requests to the homepage
- Rename the admin user account to 'webmaster'
- Enable the overlay module to hide admin pages from the browser URL bar
Correct answer: Restrict admin paths using Drupal's permission system and optionally an HTTP authentication layer
Combining Drupal's role-based access control with an additional HTTP authentication layer (e.g., at the web server level) provides defense-in-depth for admin paths.
Question 3: Which risk does the Drupal 'Trusted Host Settings' configuration ($settings['trusted_host_patterns']) directly mitigate?
- HTTP Host header injection attacks (Correct answer)
- SQL injection through form fields
- Cross-site request forgery (CSRF) on form submissions
- Denial of service from excessive cache misses
Correct answer: HTTP Host header injection attacks
Trusted host patterns prevent attackers from injecting malicious Host headers that could be used in cache poisoning or password reset link attacks.
Question 4: During a Drupal risk review, a site is found to allow file uploads with no extension restrictions. Which module helps mitigate this risk?
- Configuring the allowed file extensions list in each file field's settings (Correct answer)
- Installing the Devel module to monitor uploaded files
- Enabling PHP filter module to process uploaded files
- Granting the 'administer files' permission only to admins
Correct answer: Configuring the allowed file extensions list in each file field's settings
Restricting allowed file extensions in each file/image field's configuration is the primary control preventing dangerous file type uploads.
Question 5: What risk is introduced when Drupal's update.php is left accessible without authentication after a site update?
- Any visitor could run database updates and potentially corrupt data or escalate privileges (Correct answer)
- Search engines would index the update log and expose version information
- The site's cron jobs would run update.php on every cron cycle
- Update.php would overwrite custom modules with core defaults
Correct answer: Any visitor could run database updates and potentially corrupt data or escalate privileges
An unauthenticated update.php allows anyone to trigger database schema changes, risking data corruption, denial of service, or privilege escalation.
Question 6: Which risk management concept is applied when a Drupal site keeps a tested rollback snapshot before every major update?
- Risk mitigation through contingency planning (Correct answer)
- Risk acceptance with documented justification
- Risk transference to a third-party backup vendor
- Risk avoidance by never updating Drupal
Correct answer: Risk mitigation through contingency planning
Maintaining rollback snapshots is a contingency planning control that mitigates the impact of a failed update.
Question 7: A penetration test reveals that Drupal's private file system path is inside the web root. What risk does this create?
- Private files become directly downloadable via URL without Drupal's access checks (Correct answer)
- Private files are automatically indexed by Drupal's search engine
- The file system path becomes shared with anonymous user sessions
- Drupal's cron will delete private files to free web root space
Correct answer: Private files become directly downloadable via URL without Drupal's access checks
Placing the private file directory inside the web root allows direct URL access, bypassing Drupal's access control layer entirely.
Drupal Risk Assessment & Management 3
Which Drupal feature helps assess the risk exposure of a site's configuration by comparing current settings against known best practices?