CAS-004 Governance, Risk, and Compliance Practice Question
A company wants to ensure that its data handling practices align with the principle of 'privacy by design'. Which of the following actions best supports this principle?
⚠ Common exam trap
CAS-005 often tests the misconception that any privacy-related control (encryption, audits, training) satisfies 'privacy by design', when the principle specifically requires proactive architectural integration before the system is built.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incorporating privacy controls during the initial system architecture
Privacy by design, codified in GDPR Article 25 and the ISO/IEC 27550 framework, requires that privacy protections be embedded into systems and processes from the outset rather than bolted on afterward. Incorporating privacy controls during initial system architecture — data minimization, purpose limitation, access controls, retention policies — is the textbook embodiment of this principle. The other options are reactive or partial measures that do not satisfy the 'by design' requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Incorporating privacy controls during the initial system architecture
Why this is correct
Embedding privacy controls at the initial system architecture stage satisfies privacy by design, which requires data protection to be built into systems from the outset rather than bolted on after deployment. Retrofitting later cannot match this preventative, architecture-level alignment.
- ✗
Encrypting data at rest only
Why it's wrong here
Encryption at rest protects stored data but does nothing at the design stage, so it does not embed privacy into how data is collected, minimised or used. It is tempting because encryption is a genuine privacy control, and would be correct when securing data already held in storage or backups.
- ✗
Performing an annual privacy audit
Why it's wrong here
An annual audit detects compliance gaps retrospectively, after processing has been designed and deployed, so it cannot embed privacy into the system itself. It is tempting because audits are a recognised privacy assurance activity, and would be correct for verifying ongoing adherence to an established data handling policy.
- ✗
Providing privacy training to employees
Why it's wrong here
Training changes staff behaviour but leaves the system's data collection, retention and minimisation design untouched, so privacy is not built into processing. It is tempting because awareness training is a real privacy measure, and would be correct for reducing human error in handling personal data.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.