Drupal-Site-Builder Acquia Certified Drupal Site Builder Exam for Drupal 10, 11 Questions and Answers

Drupal handles date and time display through regional settings and user account timezone preferences , not through content type configuration. The correct solutions are therefore A and C . Enabling “Users may set their own time zone” allows authenticated users to choose their own timezone in their user account settings, so dates such as content publication times are displayed according to each user’s local timezone. This is the most accurate solution when users may come from different regions.

Changing the default timezone to that of your primary audience, in this case France, is also correct. Drupal uses the site default timezone for users who have not set a personal timezone, and for anonymous visitors. This makes displayed times more appropriate for the majority of site visitors.

Option B is incorrect because Drupal does not provide timezone handling at the content type level. Timezone behavior is managed globally and per user, not per content type. Option D is also incorrect because setting the default country affects address-related defaults and locale-related behavior, but it does not control how Drupal displays timestamps. Therefore, the verified answers are A and C .

In Drupal 10 (Standard installation profile), several roles are created automatically to support common editorial workflows. These include Authenticated user , Content editor , and Administrator .

Authenticated user is a core default role in all Drupal installations. It represents any logged-in user and is always present.

Content editor is provided by the Standard installation profile as part of Drupal’s out-of-the-box editorial workflow, allowing users to create and manage content.

Administrator is also included and has full permissions to manage the entire site.

Options A (Site builder) and C (Publisher) are not default roles created by Drupal core or the Standard profile. While such roles can be created manually or may appear in specific distributions, they are not included by default.

Drupal’s documentation for installation profiles confirms that the Standard profile provides a pre-configured editorial setup, including roles like Content editor, in addition to the core Authenticated user and Administrator roles.

Therefore, the correct answers are B, D, and E .

In Drupal 10 and Drupal 11, security updates for contributed modules must be applied promptly to protect the site from known vulnerabilities. Drupal core provides a built-in Update Manager module that notifies administrators when updates, especially security releases, are available. However, Drupal does not automatically install updates , including during cron runs, so option C is incorrect.

The correct process, as documented in Drupal’s official update procedures, involves downloading the latest recommended release of the module (typically via Composer or manual replacement), and then running database updates using the /update.php script or drush updb . This ensures that any schema changes required by the new version are properly applied.

Option B is incorrect because uninstalling a module is unnecessary and can lead to data loss or configuration issues. Option A is clearly wrong, as ignoring security updates exposes the site to risks.

Therefore, the proper and documented approach is to update the module codebase and run update.php to finalize the update process, making option D the correct answer.

Drupal’s official security guidance for the super user account ( user 1 ) specifically recommends that administrators do not name the first account “admin” or something obvious . The reason is straightforward: obvious usernames make brute-force and credential-guessing attacks easier, because attackers already know half of the login credentials they need to target. Drupal’s administration and security documentation also recommends limiting direct use of user 1 and protecting it carefully because it is a uniquely powerful account.

That makes option D the correct answer. The other options do not match Drupal’s documented best practices. There is no Drupal security rule about “members of the Drupal community in good standing” being allowed to use user 1. Canceling the user 1 account is not the recommended solution for this situation, and removing the Administrator role from user 1 would not make the account anonymous; in Drupal, user 1 is a special account with superuser behavior that is handled separately from ordinary role assignment. Drupal’s own guidance emphasizes safer naming and tighter handling of the account, not these alternative actions.

Drupal’s recommended solution for reusable images with their own metadata is to use Media entities , not ordinary image fields on content. Core documentation and issue work around Media in Drupal explain that moving from regular image fields to media image fields is what enables reuse of the same image asset across multiple pieces of content.

That means the description should live on the media item itself , together with the image, and content types should reference that media item through a media reference field . Drupal field documentation also confirms that fields can be attached to entities and reused appropriately through references. So creating a new media type with an image field plus a description field is valid, and adding a description field to an existing Image media type is also valid. Both approaches satisfy the requirement that the image and its description stay together and can be reused elsewhere.

Option B is incorrect because Drupal core already provides Media for this use case. Option C is not the best content model because a content type represents publishable content, while reusable images-with-metadata are better modeled as Media assets.

Drupal controls HTML markup through text formats and filters . The official User Guide explains that text formats such as Basic HTML and Full HTML determine which tags are allowed, and these formats exist specifically to protect the site from unsafe markup such as XSS. Because of that, if editors need to use < div > tags, one valid solution is to configure the content so it can use the Full HTML text format, which is the most permissive core format. Drupal also supports restricting or allowing which text formats are available on a formatted text field, including the Body field.

Another valid solution is to edit the Basic HTML text format and add < div > to the list of allowed HTML tags. Drupal’s text format configuration page explicitly allows administrators to change the Allowed HTML tags for Basic HTML. That makes option C correct as well. Option B is incorrect because Drupal does not use a permission named “Use advanced HTML”; permissions are tied to specific text formats. Option D is incorrect because theme settings do not control which tags are allowed in editor input.

In Drupal 10 and Drupal 11, Views contextual filters are used to dynamically filter content based on values passed through the URL. When filtering content by taxonomy (such as Landmarks), you configure a contextual filter using the taxonomy term field associated with the content type.

To pass a value like a term name in the URL , you must configure the contextual filter to accept term identifiers such as term ID or term name . Drupal Views allows validation and transformation of contextual input, including using the taxonomy term name via settings like “Provide default value” or “Specify validation criteria.” This matches option B.

Option A is incorrect because exposed filters rely on user input via UI forms, not URL path arguments. Option C is unnecessary duplication and not aligned with best practices. Option D is not required because taxonomy reference fields already provide the necessary relationship internally for filtering; explicitly adding a relationship is only needed in more complex multi-entity scenarios.

Therefore, the correct approach is to use a contextual filter configured to accept the taxonomy term (including term name) via the URL, making option B correct.

Drupal 10 and Drupal 11 are flexible because they provide major site-building capabilities through configuration and core modules, instead of requiring everything to be custom-coded. Drupal supports headless/decoupled use cases out of the box through core web services such as JSON:API , which Drupal documentation describes as a standard way to expose site content for decoupled applications. That makes A correct.

Drupal also provides strong content modeling through entity types and fields, and it supports listing and displaying content through the Views UI . The User Guide and core documentation explain that site builders can define structured content types and then create listings, pages, blocks, sorting, and filtering through Views without writing custom code. That makes B correct.

Drupal additionally ships with a rich administrative interface for installing modules, managing themes, creating content types, editing fields, configuring permissions, and administering content. This is one of the platform’s core strengths compared with a purely custom-built system, so E is correct.

Options C and D are not correct. Drupal.org provides contributed projects, but not an online store for buying modules and themes, and Drupal does not present direct database-column renaming as a normal UI-based site-building feature.

Drupal uses text formats and filters to control how HTML input is processed before being displayed. One of the available filters is “Correct faulty and chopped off HTML” , which is specifically designed to fix improperly formatted or broken HTML markup.

According to Drupal documentation, this filter ensures that HTML pasted into editors (like CKEditor) is automatically cleaned and corrected , such as closing unclosed tags, fixing malformed markup, and preventing rendering issues. This is particularly useful when users paste HTML from external sources, which often includes inconsistent or invalid markup.

Option D is correct because it directly addresses the issue at the text format level without restricting allowed tags, maintaining the requirement to allow all HTML elements.

Option C is incorrect because enabling “Limit allowed HTML tags” would restrict HTML usage, which contradicts the requirement to allow all elements. Options A and B are not standard Drupal solutions and do not align with Drupal’s built-in filtering system.

Therefore, enabling the Correct faulty and chopped off HTML filter is the correct and recommended approach in Drupal 10 and Drupal 11.

Because all three content types use a Media reference field that allows the Image media type , the actual uploaded file restrictions are controlled by the source field on the Media type , not by each content type’s reference field. In Drupal, the Image media type contains an image field as its source field, and image/file fields have settings such as allowed file extensions . Drupal’s Image module documentation states that image fields can be configured with settings including allowed extensions .

Therefore, to block GIF uploads everywhere this Image media type is used, you edit the Image media type , go to Manage fields , edit its image source field , and remove gif from the allowed extensions. Since all three content types reference that same media type, the restriction applies consistently across all of them. This is the most efficient and Drupal-native solution.

Option A is incorrect because the media reference field on a content type controls which media types may be referenced, not which file extensions the media type’s source field accepts. Option C concerns form widget display, not file validation. Option D is too general; the actual extension restriction lives on the image field settings within the media type.

The best answer is B because the problem described is a large volume of 404 Page Not Found requests generated by a crawler, and Drupal core includes Fast 404 handling specifically to reduce the performance cost of such requests. In Drupal 10 and Drupal 11, core contains a Fast404ExceptionHtmlSubscriber and configuration under system.performance:fast_404 . Drupal’s API documentation explains that Fast 404 returns a minimalist 404 response for matching requests instead of going through the full themed page handling, which lowers processing overhead for repeated invalid URL requests.

Option A may help block a bad actor, but banning one IP address is not the Drupal-documented performance feature aimed at reducing the cost of many 404s. Option C would worsen the situation because redirecting missing pages to search adds extra processing rather than reducing it. Option D is incorrect because Drupal does not automatically block suspicious visitors just because they generate many 404 log entries. Also, Drupal 10 release notes explicitly note that Fast 404 is a core capability and that separate legacy settings.php-based handling is no longer the recommended approach.

Drupal core’s Contact module allows administrators to configure multiple contact forms, each with its own settings. One of the configurable options is the ability to define a redirect path after form submission. This is done within the specific contact form’s configuration, where you can specify the destination page users should be taken to after submitting the form.

Option D is correct because Drupal provides a “Redirect path” setting directly in the contact form configuration , making it possible to send users to a custom page such as a thank-you or confirmation page after submission.

Option A is incorrect because Drupal core already supports this functionality without needing a contributed module like Webform. Option B is incorrect because Site information settings do not control form submission redirects. Option C is not relevant, as redirect behavior is not controlled through user profiles.

Thus, the correct Drupal-native solution is to configure the redirect path within the contact form settings, making D the correct answer.