Drupal Risk Assessment & Management 3

Question 1

Which Drupal feature helps assess the risk exposure of a site's configuration by comparing current settings against known best practices?

Accepted Answer

The Security Review module

Answer

The Security Review module automatically checks Drupal configuration against common security best practices and reports risks.

Question 2

A risk assessment identifies that anonymous users can access Drupal's /admin path. What is the correct mitigation?

Accepted Answer

Restrict admin paths using Drupal's permission system and optionally an HTTP authentication layer

Answer

Combining Drupal's role-based access control with an additional HTTP authentication layer (e.g., at the web server level) provides defense-in-depth for admin paths.

Question 3

Which risk does the Drupal 'Trusted Host Settings' configuration ($settings['trusted_host_patterns']) directly mitigate?

Accepted Answer

HTTP Host header injection attacks

Answer

Trusted host patterns prevent attackers from injecting malicious Host headers that could be used in cache poisoning or password reset link attacks.

Question 4

During a Drupal risk review, a site is found to allow file uploads with no extension restrictions. Which module helps mitigate this risk?

Accepted Answer

Configuring the allowed file extensions list in each file field's settings

Answer

Restricting allowed file extensions in each file/image field's configuration is the primary control preventing dangerous file type uploads.

Question 5

What risk is introduced when Drupal's update.php is left accessible without authentication after a site update?

Accepted Answer

Any visitor could run database updates and potentially corrupt data or escalate privileges

Answer

An unauthenticated update.php allows anyone to trigger database schema changes, risking data corruption, denial of service, or privilege escalation.

Drupal Practice Test

Drupal Practice Test

Drupal Risk Assessment & Management 3