WordPress Risk Assessment & Management 5

Question 1

Which WordPress configuration hardens security by preventing direct PHP file execution in the uploads directory?

Accepted Answer

Adding an .htaccess rule to deny PHP execution in wp-content/uploads/

Answer

Blocking PHP execution in the uploads directory prevents attackers from running malicious scripts they've uploaded as image or media files.

Question 2

What risk does 'user enumeration' present to a WordPress site?

Accepted Answer

It allows attackers to discover valid usernames to target with brute-force attacks

Answer

WordPress exposes usernames via the author archives by default; knowing valid usernames gives attackers half the credentials needed to log in.

Question 3

In a business impact analysis (BIA) for a WordPress e-commerce site, what does RTO stand for?

Accepted Answer

Recovery Time Objective — the maximum acceptable downtime after an incident

Answer

RTO defines how quickly a system must be restored after a failure to avoid unacceptable business impact.

Question 4

A WordPress multisite network's super admin account is compromised. What is the blast radius compared to a single-site admin compromise?

Accepted Answer

Much larger — all sites in the network are at risk simultaneously

Answer

A super admin has unrestricted control over every site in the multisite network, so one compromised account affects the entire network.

Question 5

Which WordPress update strategy best balances security risk with stability risk?

Accepted Answer

Apply security updates promptly and test major updates on staging first

Answer

Security patches should be applied quickly to close vulnerabilities, while major updates benefit from staging validation to catch compatibility issues.

WordPress Practice Test

WordPress Practice Test

WordPress Risk Assessment & Management 5