WordPress Risk Assessment & Management 3 — Questions and Answers
Question 1: Which method best mitigates the risk of a compromised admin account on WordPress?
- Using a long username
- Enabling two-factor authentication (2FA) (Correct answer)
- Hiding the admin dashboard color scheme
- Setting a weekly password reminder
Correct answer: Enabling two-factor authentication (2FA)
Two-factor authentication adds a second verification layer, making stolen credentials alone insufficient for account access.
Question 2: A WordPress site owner discovers an installed plugin has been abandoned for 3 years. What is the most appropriate risk response?
- Continue using it since it still works
- Replace it with an actively maintained alternative (Correct answer)
- Disable it only during business hours
- Increase server RAM to compensate
Correct answer: Replace it with an actively maintained alternative
Abandoned plugins do not receive security patches, leaving unaddressed vulnerabilities that attackers can exploit.
Question 3: Which WordPress file, if publicly accessible, poses a significant information disclosure risk?
- style.css
- wp-config.php (Correct answer)
- index.php
- functions.php
Correct answer: wp-config.php
wp-config.php contains database credentials and secret keys; if readable by the public, it compromises the entire site.
Question 4: What risk does enabling XML-RPC on a WordPress site primarily introduce?
- Slower page load times
- Amplified brute-force attacks and DDoS via pingback abuse (Correct answer)
- Broken theme customization
- Loss of SEO metadata
Correct answer: Amplified brute-force attacks and DDoS via pingback abuse
XML-RPC allows attackers to attempt thousands of login combinations in a single request and can be abused for DDoS via pingbacks.
Question 5: In WordPress risk management, 'residual risk' refers to:
- Risks that have already caused damage
- Risk remaining after all mitigation controls have been applied (Correct answer)
- Risks identified but not yet assessed
- The cost of implementing security plugins
Correct answer: Risk remaining after all mitigation controls have been applied
Residual risk is what remains after controls are in place; it must be accepted, transferred, or further reduced.
Question 6: A WordPress e-commerce site processes payments via a hosted payment gateway. How does this affect PCI DSS risk scope?
- It eliminates all PCI DSS obligations
- It significantly reduces scope since card data never touches your server (Correct answer)
- It increases scope because you control the gateway
- It has no effect on compliance requirements
Correct answer: It significantly reduces scope since card data never touches your server
Using a hosted payment gateway means card data is processed off-site, substantially reducing the merchant's PCI DSS compliance scope.
Question 7: Which WordPress user role assignment represents the principle of least privilege?
- Giving all content editors Administrator access for convenience
- Assigning users only the role that matches their actual job function (Correct answer)
- Creating a single shared admin account for the team
- Giving new users Subscriber role and upgrading as needed
Correct answer: Assigning users only the role that matches their actual job function
Least privilege means users receive only the permissions necessary for their specific tasks, limiting damage from compromised accounts.
WordPress Risk Assessment & Management 3
Which method best mitigates the risk of a compromised admin account on WordPress?