Drupal-Site-Builder Exam Dumps - Acquia Drupal 10/11 Questions and Answers

In Drupal 10 and Drupal 11, content that appears in the sidebar across all pages is typically implemented as a custom block placed in a theme region via the Block Layout system. Drupal documentation explains that reusable content like contact information is best managed through custom blocks , which can be edited centrally and automatically update everywhere they are placed.

Option A is correct because the proper way to update such content is to go to Structure → Block layout → Custom block library , locate the block, and edit it. This ensures the change is reflected globally wherever the block is used.

Option C is also correct because Drupal provides contextual links (the pencil icon) that allow administrators to directly edit blocks from the front end. This is a standard and documented shortcut for editing block content.

Option B is incorrect because Layout Builder is not mentioned and is not required here. Option D is incorrect because editing individual pages would not update a shared sidebar block and would be inefficient and incorrect.

Thus, the correct Drupal site-building approaches are editing the custom block via the block library or using contextual links, making A and C correct.

The best answer is B because the problem described is a large volume of 404 Page Not Found requests generated by a crawler, and Drupal core includes Fast 404 handling specifically to reduce the performance cost of such requests. In Drupal 10 and Drupal 11, core contains a Fast404ExceptionHtmlSubscriber and configuration under system.performance:fast_404 . Drupal’s API documentation explains that Fast 404 returns a minimalist 404 response for matching requests instead of going through the full themed page handling, which lowers processing overhead for repeated invalid URL requests.

Option A may help block a bad actor, but banning one IP address is not the Drupal-documented performance feature aimed at reducing the cost of many 404s. Option C would worsen the situation because redirecting missing pages to search adds extra processing rather than reducing it. Option D is incorrect because Drupal does not automatically block suspicious visitors just because they generate many 404 log entries. Also, Drupal 10 release notes explicitly note that Fast 404 is a core capability and that separate legacy settings.php-based handling is no longer the recommended approach.

Drupal 10 and Drupal 11 provide multiple ways to control how content is displayed without altering the underlying data. The requirement here is to show only selected fields (image, title, cuisine) in a listing, while keeping the full description available on the detail page.

Option A is correct because Views allows you to display content as fields , meaning you can explicitly choose which fields to show. This is a core feature of the Views module and is commonly used for listing pages.

Option C is also correct because Drupal supports view modes (like Teaser and Full). The documentation explains that you can configure the Teaser view mode to show only selected fields. Then, in Views, you can display content using that view mode. This approach is reusable and aligns with Drupal’s display system.

Option B is incorrect because creating a duplicate content type is unnecessary and violates content modeling best practices. Option D is incorrect because hiding fields with CSS does not remove them from the rendered output and is not a proper Drupal solution.

Thus, using Views fields or Teaser view mode are the correct, documented approaches.

Drupal’s Comment module supports creating different comment types and attaching them to content entities. The official Comment module documentation states that Drupal can create new comment types that can be attached to content entities, and the detailed comment documentation explains that when you create a comment type and choose the target entity type as Content , that comment type becomes available when adding a comment field to a content type.

Drupal’s field documentation also explains that fields on comments are defined at the content-type level , on the Comment fields tab of the content type edit page. When you add a field for comments, each comment on content items of that type gets that field. Drupal even gives an example of adding a field to comments for one content type but not another, which matches this requirement exactly.

So the right solution is to create a new comment type for Places comments, add a Country field to that comment type, and then use that comment type on the Places content type only. The other options either store the data in the wrong place or do not make it specific to comments on Places.

Drupal 10 and Drupal 11 documentation recommends planning content structure by identifying each kind of content and then creating an appropriate content type with separate fields for each distinct piece of information. Drupal’s User Guide explains that content entities are made up of fields, and that when you add a content type, you can then add fields such as date, image, link, text, and other structured values. This structured approach is what makes content easier to manage, search, sort, reuse in Views, and display in different ways.

For an events use case, the correct model is a single Event content type with discrete fields for title, description, scheduled date, image, and contact information. Storing all event details in one body field or splitting them into unrelated content types would make sorting and display much harder. Drupal’s planning guidance also says to choose the content entity type based on how the content will be used and edited, while blocks are better for reusable page-region content, not for primary structured records like event listings.

The most effective and Drupal-recommended way to prevent automated (bot-driven) user registrations is to implement a challenge-response mechanism such as CAPTCHA. In Drupal 10 and Drupal 11, this is achieved using the CAPTCHA module (often paired with reCAPTCHA), which integrates directly into forms like user registration. By enabling a CAPTCHA field on the registration form, bots are prevented from submitting automated requests because they cannot solve the challenge, while legitimate users can proceed normally.

Drupal’s security best practices emphasize mitigating automated abuse at the form level rather than relying solely on post-registration controls. Option A (email verification) still allows bots to create accounts and flood the system, even if they cannot activate them. Option C (hiding login) does not affect registration endpoints and provides no real protection. Option D (restricting registration to administrators only) eliminates self-registration entirely, which may not meet business requirements and is not a balanced solution.

Therefore, enabling CAPTCHA directly addresses the root cause—automated submissions—making it the most appropriate and scalable solution according to Drupal security guidelines.

Drupal handles date and time display through regional settings and user account timezone preferences , not through content type configuration. The correct solutions are therefore A and C . Enabling “Users may set their own time zone” allows authenticated users to choose their own timezone in their user account settings, so dates such as content publication times are displayed according to each user’s local timezone. This is the most accurate solution when users may come from different regions.

Changing the default timezone to that of your primary audience, in this case France, is also correct. Drupal uses the site default timezone for users who have not set a personal timezone, and for anonymous visitors. This makes displayed times more appropriate for the majority of site visitors.

Option B is incorrect because Drupal does not provide timezone handling at the content type level. Timezone behavior is managed globally and per user, not per content type. Option D is also incorrect because setting the default country affects address-related defaults and locale-related behavior, but it does not control how Drupal displays timestamps. Therefore, the verified answers are A and C .

The main security risk in this scenario is the unrestricted file upload field exposed to anonymous users. Drupal’s file API documentation explains that file uploads must use validation and a defined list of allowed extensions. Core specifically notes that uploading arbitrary files is dangerous and that validation is necessary. The Drupal file API also states that using a managed file field with defined allowed extensions helps sanitize filenames, validate files, and block insecure extensions by default. Without those restrictions, anonymous visitors could upload unsafe files, including malicious or infected files, to the server.

Option A is too broad, because anonymous users can legitimately access public forms on Drupal sites. The issue is not public access by itself, but public access combined with missing validation and upload restrictions . Option C describes a possible performance problem, not the most important security threat identified by Drupal’s documentation. Option D is clearly incorrect because Drupal’s security guidance stresses protecting public forms and validating uploads carefully, especially on forms exposed to anonymous users.

In Drupal 10 and Drupal 11, security updates for contributed modules must be applied promptly to protect the site from known vulnerabilities. Drupal core provides a built-in Update Manager module that notifies administrators when updates, especially security releases, are available. However, Drupal does not automatically install updates , including during cron runs, so option C is incorrect.

The correct process, as documented in Drupal’s official update procedures, involves downloading the latest recommended release of the module (typically via Composer or manual replacement), and then running database updates using the /update.php script or drush updb . This ensures that any schema changes required by the new version are properly applied.

Option B is incorrect because uninstalling a module is unnecessary and can lead to data loss or configuration issues. Option A is clearly wrong, as ignoring security updates exposes the site to risks.

Therefore, the proper and documented approach is to update the module codebase and run update.php to finalize the update process, making option D the correct answer.

Drupal distinguishes between interface text and configuration text . The built-in labels and other text that come from Drupal core, modules, and themes are handled by the Interface Translation system, and Drupal can download those translations for added languages. The Drupal User Guide explains that this built-in text is typically translated by downloading available translations rather than translating it yourself.

By contrast, field labels are configuration. Drupal’s multilingual documentation says that configuration text includes items such as labels for fields in your content types , and the Configuration Translation module provides the interface to translate that configuration into other languages. It also specifically lists Content fields as translatable configuration elements. That means field labels you created yourself in Spanish are not automatically translated into French just because French is added; they must be translated through configuration translation.

So, when French is added, Drupal can automatically provide translations for built-in field/interface text where translations exist, but custom field configuration labels still require manual translation . Therefore, option C is the correct answer.