Drupal Risk Assessment & Management 4 — Questions and Answers
Question 1: Which practice reduces the risk of a supply-chain attack via Drupal's contributed module ecosystem?
- Using Composer with a composer.lock file and verifying package hashes (Correct answer)
- Downloading modules as ZIP archives directly from third-party mirror sites
- Installing all available modules to test features before choosing one
- Disabling module update notifications to reduce noise
Correct answer: Using Composer with a composer.lock file and verifying package hashes
Composer's lock file pins exact package versions and checksums, making it harder for tampered packages to be silently introduced.
Question 2: A Drupal site's risk assessment notes that database credentials are stored in settings.php inside the web root. What is the best remediation?
- Move settings.php outside the web root or use environment variables for credentials (Correct answer)
- Encode the database password in Base64 within settings.php
- Remove read permissions on settings.php for the web server user
- Store credentials in a Drupal config YAML file instead
Correct answer: Move settings.php outside the web root or use environment variables for credentials
Moving settings.php outside the web root or using environment variables ensures credentials are never directly accessible via HTTP even if directory listing is misconfigured.
Question 3: Which Drupal logging feature supports risk management by providing an audit trail of administrative actions?
- The Database Logging (dblog) module combined with the Syslog module for off-server storage (Correct answer)
- The Devel module's query log for live debugging
- Drupal's built-in Google Analytics integration
- The Views module's query caching layer
Correct answer: The Database Logging (dblog) module combined with the Syslog module for off-server storage
Combining dblog with Syslog (or a SIEM integration) creates a tamper-resistant audit trail of admin actions stored off the compromised server.
Question 4: An organization accepts the risk of running an end-of-life Drupal version on an isolated internal tool. Which risk management strategy does this represent?
- Risk acceptance with documented justification (Correct answer)
- Risk avoidance by decommissioning the tool
- Risk transference by purchasing cyber insurance
- Risk mitigation through emergency patching
Correct answer: Risk acceptance with documented justification
Consciously deciding to tolerate a known risk with formal documentation is the definition of risk acceptance.
Question 5: Which Drupal permission represents a critical risk if granted to untrusted roles?
- 'Use PHP for settings' or 'Administer software updates' (Correct answer)
- 'View published content' and 'Access content overview'
- 'Post comments' and 'Skip comment approval'
- 'Use the administration toolbar' and 'Access the site in maintenance mode'
Correct answer: 'Use PHP for settings' or 'Administer software updates'
Permissions that allow PHP execution or software updates give a role the ability to run arbitrary code or introduce vulnerable modules.
Question 6: A risk analysis shows that a Drupal site's session cookie lacks the Secure flag. What attack does this enable?
- Session hijacking over unencrypted HTTP connections (Correct answer)
- Cross-site scripting injection into session tokens
- SQL injection through cookie-based query parameters
- Clickjacking via iframe embedding of the login page
Correct answer: Session hijacking over unencrypted HTTP connections
Without the Secure flag, session cookies are transmitted over plain HTTP, allowing network attackers to capture and reuse them.
Question 7: Which risk is introduced by enabling Drupal's PHP filter module on a production site?
- Content editors can embed executable PHP code directly in nodes, enabling remote code execution (Correct answer)
- PHP filter module disables Drupal's caching layer site-wide
- Enabling PHP filter exposes Drupal's database schema through introspection
- PHP filter removes CSRF tokens from all forms on the site
Correct answer: Content editors can embed executable PHP code directly in nodes, enabling remote code execution
The PHP filter module allows users with the right permission to insert and execute PHP within content, creating a severe remote code execution risk.
Drupal Risk Assessment & Management 4
Which practice reduces the risk of a supply-chain attack via Drupal's contributed module ecosystem?