Acquia Certified Drupal Site Builder Cheat Sheet

Exam Details: 75 minutes | 50 questions | 68% passing score

This cheat sheet covers all six domains of the Acquia Certified Drupal Site Builder exam. Master these concepts and you'll be well-prepared to pass.

Domain 1: Understanding Drupal (12%)

Drupal Architecture Overview

Drupal is a content management system (CMS) built in PHP. It uses a modular architecture where functionality is provided by modules and visual presentation by themes.

Key Terminology:

• Node → A piece of content (article, page, blog post)
• Entity → A data object with fields (nodes, users, taxonomy terms, blocks)
• Bundle → A subtype of an entity (e.g., "Article" is a bundle of the Node entity type)
• Module → PHP code that extends Drupal's functionality
• Theme → Templates and CSS that control visual presentation
• Region → A defined area in a theme layout where blocks can be placed

Content Entities vs Configuration Entities

Content Entities store user-created data:

• Nodes (content)
• Users
• Taxonomy terms
• Comments
• Media
• Custom blocks

Configuration Entities store site structure and settings:

• Content types
• Views
• Image styles
• Text formats
• Field configurations

Configuration entities can be exported as YAML files for deployment between environments.

Admin Interface Navigation

Supported Databases

• MySQL / MariaDB → Most common
• PostgreSQL → Full support
• SQLite → Development and testing

Domain 2: Content Modeling (28%)

Content Types

Content types define the structure for categories of content. Each content type has its own set of fields, form settings, and display settings.

Default Content Types:

• Article → Has body, image, and tags fields
• Basic page → Has only a body field

Creating a Content Type:

Structure → Content types → Add content type

Publishing Options (defaults for new content):

• Published (visible to visitors)
• Promoted to front page
• Sticky at top of lists
• Create new revision

Field Types

Key Field Concepts:

• Cardinality → How many values a field can hold (1, limited, unlimited)
• Required → Must be filled before saving
• Default value → Pre-populated on the creation form
• Help text → Instructions shown below the field on the edit form

Widgets vs Formatters

• Widget → Controls how a field appears on the edit form (input element)
• Formatter → Controls how a field appears on the display (output rendering)

Manage form display → Configure widgets (edit form)

Manage display → Configure formatters (visitor-facing display)

Taxonomy

1Vocabulary (container)
2└── Terms (classification labels)
3    ├── Parent term
4    │   ├── Child term
5    │   └── Child term
6    └── Another term

When to use Taxonomy vs List field:

• Taxonomy → Growing list, needs hierarchy, needs term pages, editors add new values
• List (text) → Fixed, small set of options unlikely to change

Free tagging: Use the "Autocomplete (Tags style)" widget on an entity reference field to let editors add new terms.

View Modes

Named display configurations that show different fields for different contexts:

• Full → Complete content view
• Teaser → Summary for listing pages
• Search result → Search listings
• Custom → Any additional contexts you define

Each view mode has independent field visibility, order, and formatter settings.

Media System

The Media module provides reusable media entities (images, videos, files) that can be referenced from multiple content items.

Key benefits:

• Reuse same image across multiple pages
• Centralized metadata (alt text, captions)
• Media Library provides visual browser for selecting assets

Best practice: Use a Media reference field instead of a direct Image/File field.

Content Moderation

An editorial workflow system with custom states and transitions:

• Draft → Content being written
• In Review → Awaiting editorial approval
• Published → Visible to the public

Transitions between states are controlled by permissions.

Revisions

When enabled, each save creates a new revision. Editors can:

• View revision history
• Compare revisions
• Revert to previous versions

Domain 3: Site Display (20%)

Views

The Views module creates custom listings of content. It's the most powerful site-building tool in Drupal.

Display Types:

• Page → Creates a standalone URL path
• Block → Creates a placeable block for regions
• Feed → Generates RSS/XML output
• Attachment → Attaches to other View displays

Key Components:

• Fields → What data to display
• Filter criteria → Fixed conditions (e.g., only published content)
• Exposed filters → User-controlled filters (dropdowns, search boxes)
• Sort criteria → Display order (newest first, alphabetical, etc.)
• Contextual filters → Dynamic values from URL or context
• Relationships → JOIN related entities
• Pager → Pagination settings

Row Formats:

• Content → Renders entity using a view mode (Teaser, Full, etc.)
• Fields → Shows individual fields selected in the View

View Formats:

• Unformatted list
• HTML list
• Table (with sortable headers)
• Grid (rows and columns)

AJAX: Enable "Use AJAX" for pagination and filters without full page reload.

Blocks

Blocks are chunks of content or functionality placed in theme regions.

Placement: Structure → Block layout

Visibility Conditions:

• Pages → Show on specific URL paths
• Content types → Show on specific content type pages
• User roles → Show to specific roles
• Language → Show for specific language

Custom Block Types: Can have their own fields, similar to content types.

Menus

Default Menus:

• Main navigation → Primary site navigation
• Footer → Footer links
• Administration → Admin toolbar
• User account menu → Login/logout links
• Tools → Utility links

Adding menu links: Check "Provide a menu link" on content edit forms.

Creating submenus: Set the "Parent link" on menu items.

Layout Builder

A core module for visually arranging page layouts:

• Drag-and-drop sections and blocks
• Configure section layouts (1-column, 2-column, etc.)
• Place blocks within sections
• Override per-entity or set defaults for content types

Domain 4: Site Configuration (20%)

User Roles and Permissions

Default Roles:

• Anonymous user → Not logged in
• Authenticated user → Logged in
• Administrator → Full access (bypasses permission checks)

Key rules:

• Permissions are additive — no deny mechanism
• A user with multiple roles gets the combined permissions
• Administrator role has a special "bypass all" flag

Dangerous permissions to restrict:

• Administer users → Can assign admin role to anyone
• Use Full HTML text format → XSS risk if given to untrusted users
• Administer site configuration → Full site settings access

Text Formats

URL Aliases

• Manual: Set in the "URL path settings" section of each content edit form
• Automatic: Install Pathauto module for pattern-based generation (e.g., /blog/[node:title])

Configuration Management

Export and import site configuration as YAML files:

• Full sync: Configuration → Development → Configuration synchronization
• Single item: Export/import individual config entities
• Drush commands:

1drush config:export   # Export config to files
2drush config:import   # Import config from files

Account Settings

Configuration → People → Account settings:

• Registration: Visitors can register / Need approval / Admins only
• Email notifications: Welcome, approval, password reset templates
• Default role assignment for new users

Cron

Periodic maintenance tasks (search indexing, update checks, log cleanup):

• Configuration: /admin/config/system/cron
• Production: Use external cron (OS crontab or Drush)
• Manual: Reports → Status report → Run cron

Error Pages

Set custom 403 (Access Denied) and 404 (Not Found) pages in:

Configuration → System → Basic site settings → Error pages

Multilingual Setup

Core modules needed:

• Language → Multilingual framework
• Content Translation → Translate content entities
• Interface Translation → Translate UI strings
• Configuration Translation → Translate config

Language detection methods: URL prefix, domain, browser, user preference

Domain 5: Community and Contributed Projects (12%)

Finding Modules

All contributed modules are published on drupal.org/project/modules.

Evaluation criteria:

• ✅ Security advisory coverage (shield icon)
• ✅ High number of reported installations
• ✅ Recent commit activity and issue responses
• ✅ Stable release available (not just dev)
• ✅ Compatible with your Drupal core version

Installing Modules with Composer

1# Add a module
2composer require drupal/pathauto
3
4# Enable it
5drush en pathauto
6# Or: Extend page → check the box → Install

File locations (Composer-managed):

• modules/contrib/ → Contributed modules
• modules/custom/ → Custom modules
• core/modules/ → Core modules
• themes/contrib/ → Contributed themes
• themes/custom/ → Custom themes

Updating Modules

1# Check for updates
2drush pm:security   # Security updates only
3
4# Update a specific module
5composer update drupal/views_bulk_operations
6
7# Run database updates after code changes
8drush updatedb
9# Or visit: /update.php

Before updating production:

1. Backup database and codebase
2. Test on staging environment first

Themes

• Base theme → Provides foundational templates that child themes inherit
• Starterkit generator → Core command to scaffold new custom themes:

1php core/scripts/drupal generate-theme my_custom_theme

Popular Contributed Modules

• Pathauto → Automatic URL alias generation
• Token → Dynamic replacement patterns
• Metatag → SEO meta tags management
• Redirect → URL redirect management
• Admin Toolbar → Enhanced admin menu with dropdowns
• Paragraphs → Component-based content authoring

Version Compatibility

The core_version_requirement in a module's .info.yml file declares compatibility:

1core_version_requirement: ^10 || ^11

Domain 6: Security and Performance (8%)

Security Best Practices

• Apply security updates immediately — especially "Highly Critical" advisories
• Restrict text format permissions — never give Full HTML to untrusted roles
• Principle of least privilege — assign minimum required permissions
• Require admin approval for new user registrations
• Configure trusted host patterns in settings.php to prevent HTTP Host header attacks
• Review the Status report regularly for security warnings

Caching

Internal Page Cache: Caches entire pages for anonymous users. No database queries needed for cached pages.

Dynamic Page Cache: Caches pages for authenticated users by caching non-personalized elements and inserting personalized fragments.

Browser Caching: Set cache lifetimes for static assets in Performance settings.

Performance Configuration

Configuration → Development → Performance:

• ✅ Enable page caching for anonymous users
• ✅ Enable CSS aggregation (combines CSS files)
• ✅ Enable JavaScript aggregation (combines JS files)
• Set appropriate cache maximum age

Production Recommendations

• Replace Database Logging (dblog) with Syslog to avoid database writes for every log entry
• Use an external cron instead of Drupal's automated cron (avoids page load latency)
• Enable CSS/JS aggregation to reduce HTTP requests
• Review and disable unnecessary modules

Security Advisories

The Drupal Security Team monitors:

• Drupal core → Critical patches released on Wednesdays
• Contributed modules → With "Security advisory coverage"

Check for updates: Reports → Available updates

Subscribe to advisories: drupal.org/security

Quick Reference

Admin Paths

Drush Commands

1drush cr                  # Clear/rebuild cache
2drush en module_name      # Enable module
3drush pm:uninstall module # Uninstall module
4drush config:export       # Export configuration
5drush config:import       # Import configuration
6drush updatedb            # Run database updates
7drush cron                # Run cron
8drush user:login          # Generate one-time login URL

Exam Tips

Pro Tips:

• Focus most study time on Content Modeling (28%) — it's the largest domain
• Know the admin paths for common tasks
• Understand the difference between widgets (edit form) and formatters (display)
• Know when to use taxonomy vs list fields
• Remember: permissions are additive — there is no "deny"
• Views questions are common — understand displays, filters, and contextual filters
• Know the 4 multilingual core modules and their purposes
• Understand why Full HTML text format is a security risk
• Know the difference between content entities and configuration entities
• Remember: Composer is the standard for managing dependencies, not manual downloads

Good luck on your certification! 🎉