hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A multinational corporation is implementing a…
A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a single PIA that covers both regulations' requirements
Conducting a single PIA that addresses both GDPR and CCPA requirements is the most efficient and effective approach. GDPR requires Data Protection Impact Assessments (DPIAs) for high-risk processing, while CCPA mandates risk assessments for certain activities. A single PIA can map both regulations' requirements, identify overlapping controls, and ensure comprehensive compliance. Option A is wrong because separate PIAs would be redundant and could lead to inconsistencies or gaps. Option B is wrong because skipping PIAs for existing processing violates both regulations' requirements to review ongoing activities. Option D is wrong because PIAs are required for any processing that poses risks to privacy, not only high-risk data, and GDPR requires DPIAs for specified high-risk processing but also recommends them for other activities; however, the best practice is to conduct PIAs broadly to demonstrate accountability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform separate PIAs for GDPR and CCPA requirements
Why it's wrong here
Duplicative and inefficient
- ✗
Skip PIAs for existing processing activities
Why it's wrong here
PIAs are required for high-risk processing
- ✓
Conduct a single PIA that covers both regulations' requirements
Why this is correct
Comprehensive and efficient
- ✗
Only perform PIAs when processing high-risk data
Why it's wrong here
CCPA does not mandate PIAs for all but high-risk
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.