WordPress Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: Which WordPress built-in tool allows site administrators to erase personal data for a specific user to comply with GDPR's right to erasure?
- Tools > Erase Personal Data (Correct answer)
- Users > Delete User
- Settings > Privacy > Erase
- Dashboard > Compliance
Correct answer: Tools > Erase Personal Data
WordPress includes a built-in 'Erase Personal Data' tool under the Tools menu to process right-to-erasure requests.
Question 2: A WordPress plugin that stores user data in a third country outside the EEA must ensure which of the following under GDPR?
- The data is encrypted with AES-128
- An adequacy decision, SCCs, or other valid transfer mechanism exists (Correct answer)
- The plugin is open source
- The server uses HTTPS
Correct answer: An adequacy decision, SCCs, or other valid transfer mechanism exists
GDPR restricts data transfers outside the EEA unless an adequacy decision, Standard Contractual Clauses, or another approved transfer mechanism is in place.
Question 3: Under the Americans with Disabilities Act (ADA), WordPress websites serving US customers are increasingly expected to conform to which accessibility standard?
- WCAG 2.1 Level AA (Correct answer)
- ISO 27001
- NIST 800-53
- PCI DSS Level 1
Correct answer: WCAG 2.1 Level AA
Courts and the DOJ increasingly expect US websites to meet WCAG 2.1 Level AA guidelines as the standard for ADA web accessibility compliance.
Question 4: What is the purpose of a Privacy Policy page on a WordPress site under CCPA and GDPR requirements?
- To rank higher in search engines
- To inform users about what personal data is collected and how it is used (Correct answer)
- To prevent spam form submissions
- To satisfy hosting provider requirements
Correct answer: To inform users about what personal data is collected and how it is used
Both CCPA and GDPR require a Privacy Policy that transparently informs users about data collection practices, purposes, and user rights.
Question 5: Which security practice is required by PCI DSS for WordPress sites that store, process, or transmit cardholder data?
- Daily theme updates
- Regular vulnerability scanning and penetration testing (Correct answer)
- Using only free plugins
- Disabling comments
Correct answer: Regular vulnerability scanning and penetration testing
PCI DSS Requirement 11 mandates regular vulnerability scanning and penetration testing to identify security weaknesses in systems handling cardholder data.
Question 6: A WordPress site collects email addresses for a newsletter. Under GDPR, how long may the site retain these email addresses?
- Indefinitely, as long as the site is running
- Only as long as necessary for the stated purpose or until consent is withdrawn (Correct answer)
- Exactly 3 years by default
- Until the user logs in again
Correct answer: Only as long as necessary for the stated purpose or until consent is withdrawn
GDPR's storage limitation principle requires retaining personal data only as long as necessary for the purpose or while valid consent exists.
Question 7: Which WordPress configuration step helps achieve SOC 2 Type II compliance by maintaining detailed logs of admin actions?
- Installing a caching plugin
- Enabling an activity log or audit log plugin (Correct answer)
- Switching to a static theme
- Disabling the REST API
Correct answer: Enabling an activity log or audit log plugin
SOC 2 Type II requires evidence of continuous monitoring and logging of system activity; an audit log plugin captures admin actions for this purpose.
WordPress Regulatory Frameworks & Compliance 4
Which WordPress built-in tool allows site administrators to erase personal data for a specific user to comply with GDPR's right to erasure?