WordPress Risk Assessment & Management 2 — Questions and Answers
Question 1: Which WordPress feature allows you to limit the number of login attempts to reduce brute-force attack risk?
- Built-in WordPress core setting
- Third-party plugin such as Limit Login Attempts Reloaded (Correct answer)
- Editing wp-config.php directly
- Changing the wp-admin folder name only
Correct answer: Third-party plugin such as Limit Login Attempts Reloaded
WordPress core does not natively limit login attempts, so a dedicated plugin is required to mitigate brute-force risk.
Question 2: A WordPress site stores user credit card numbers in the database. Which risk category does this primarily represent?
- Operational risk
- Compliance and legal risk (Correct answer)
- Reputational risk
- Strategic risk
Correct answer: Compliance and legal risk
Storing unencrypted payment card data violates PCI DSS regulations, making it primarily a compliance and legal risk.
Question 3: What does a WordPress site's threat model help you determine?
- The visual design of the login page
- Which specific threats are most likely and impactful for your site (Correct answer)
- The number of plugins needed
- The optimal WordPress version to use
Correct answer: Which specific threats are most likely and impactful for your site
A threat model identifies likely attackers, attack vectors, and potential impacts specific to your site's context.
Question 4: When evaluating a third-party plugin for risk, which factor is LEAST important?
- Number of active installations
- Plugin author's social media follower count (Correct answer)
- Last updated date
- Security vulnerability history
Correct answer: Plugin author's social media follower count
Social media followers have no bearing on a plugin's security quality or maintenance status.
Question 5: Which WordPress configuration change reduces the risk of exposing sensitive file paths in error messages?
- Setting WP_DEBUG to false in production (Correct answer)
- Increasing PHP memory limit
- Enabling multisite mode
- Installing a caching plugin
Correct answer: Setting WP_DEBUG to false in production
Disabling WP_DEBUG in production prevents detailed error messages and file paths from being displayed to visitors.
Question 6: A risk register for a WordPress site should include which of the following elements?
- Plugin download counts and star ratings
- Risk description, likelihood, impact, and mitigation owner (Correct answer)
- List of all installed themes
- Monthly traffic statistics
Correct answer: Risk description, likelihood, impact, and mitigation owner
A risk register documents each identified risk with its probability, potential impact, and who is responsible for mitigation.
Question 7: What is the primary purpose of setting up a staging environment for a WordPress site?
- To improve live site SEO rankings
- To test changes safely before deploying to production, reducing deployment risk (Correct answer)
- To store site backups offsite
- To run performance benchmarks on live traffic
Correct answer: To test changes safely before deploying to production, reducing deployment risk
A staging environment mirrors production and lets you validate updates and changes without risking the live site.
WordPress Risk Assessment & Management 2
Which WordPress feature allows you to limit the number of login attempts to reduce brute-force attack risk?