Drupal Risk Assessment & Management 4

Question 1

Which practice reduces the risk of a supply-chain attack via Drupal's contributed module ecosystem?

Accepted Answer

Using Composer with a composer.lock file and verifying package hashes

Answer

Composer's lock file pins exact package versions and checksums, making it harder for tampered packages to be silently introduced.

Question 2

A Drupal site's risk assessment notes that database credentials are stored in settings.php inside the web root. What is the best remediation?

Accepted Answer

Move settings.php outside the web root or use environment variables for credentials

Answer

Moving settings.php outside the web root or using environment variables ensures credentials are never directly accessible via HTTP even if directory listing is misconfigured.

Question 3

Which Drupal logging feature supports risk management by providing an audit trail of administrative actions?

Accepted Answer

The Database Logging (dblog) module combined with the Syslog module for off-server storage

Answer

Combining dblog with Syslog (or a SIEM integration) creates a tamper-resistant audit trail of admin actions stored off the compromised server.

Question 4

An organization accepts the risk of running an end-of-life Drupal version on an isolated internal tool. Which risk management strategy does this represent?

Accepted Answer

Risk acceptance with documented justification

Answer

Consciously deciding to tolerate a known risk with formal documentation is the definition of risk acceptance.

Question 5

Which Drupal permission represents a critical risk if granted to untrusted roles?

Accepted Answer

'Use PHP for settings' or 'Administer software updates'

Answer

Permissions that allow PHP execution or software updates give a role the ability to run arbitrary code or introduce vulnerable modules.

Drupal Practice Test

Drupal Practice Test

Drupal Risk Assessment & Management 4