WordPress Risk Assessment & Management 3

Question 1

Which method best mitigates the risk of a compromised admin account on WordPress?

Accepted Answer

Enabling two-factor authentication (2FA)

Answer

Two-factor authentication adds a second verification layer, making stolen credentials alone insufficient for account access.

Question 2

A WordPress site owner discovers an installed plugin has been abandoned for 3 years. What is the most appropriate risk response?

Accepted Answer

Replace it with an actively maintained alternative

Answer

Abandoned plugins do not receive security patches, leaving unaddressed vulnerabilities that attackers can exploit.

Question 3

Which WordPress file, if publicly accessible, poses a significant information disclosure risk?

Accepted Answer

wp-config.php

Answer

wp-config.php contains database credentials and secret keys; if readable by the public, it compromises the entire site.

Question 4

What risk does enabling XML-RPC on a WordPress site primarily introduce?

Accepted Answer

Amplified brute-force attacks and DDoS via pingback abuse

Answer

XML-RPC allows attackers to attempt thousands of login combinations in a single request and can be abused for DDoS via pingbacks.

Question 5

In WordPress risk management, 'residual risk' refers to:

Accepted Answer

Risk remaining after all mitigation controls have been applied

Answer

Residual risk is what remains after controls are in place; it must be accepted, transferred, or further reduced.

WordPress Practice Test