CAS-004 Governance, Risk, and Compliance Practice Question
A multinational retailer is expanding into the European Union and must transfer employee payroll data from its EU subsidiary to its US-based HR platform. Legal counsel recommends relying on the EU-US Data Privacy Framework rather than implementing Standard Contractual Clauses. Which action must the retailer take FIRST to rely on this transfer mechanism?
⚠ Common exam trap
The trap here is assuming that any US company is automatically covered by the EU-US Data Privacy Framework instead of confirming the importer's active self-certification on the official list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the US HR platform is listed as an active participant on the Data Privacy Framework List maintained by the US Department of Commerce.
The EU-US Data Privacy Framework permits transfers to US importers that have self-certified and appear on the Department of Commerce's Data Privacy Framework List. Verifying that the HR platform holds active certification is the foundational requirement; without it, the framework cannot be invoked and another transfer tool would be needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Obtain explicit consent from every EU employee before the payroll records are transmitted to the US platform.
Why it's wrong here
Consent is a derogation under Article 49 intended for occasional, non-repetitive transfers. Routine, systematic payroll processing is repetitive by nature, so consent is inappropriate and unreliable as a long-term basis. The retailer should use the framework's certification path instead of collecting employee consent.
- ✓
Verify that the US HR platform is listed as an active participant on the Data Privacy Framework List maintained by the US Department of Commerce.
Why this is correct
The EU-US Data Privacy Framework requires the receiving organization to self-certify to the US Department of Commerce and appear on the official Data Privacy Framework List. Only then can EU personal data flow to that importer without SCCs or a derogation. Confirming active certification status is the mandatory prerequisite step before the transfer can lawfully occur.
- ✗
Conduct a Transfer Impact Assessment documenting that US surveillance laws do not undermine the protection of the payroll data.
Why it's wrong here
A Transfer Impact Assessment is required when relying on Article 46 safeguards such as Standard Contractual Clauses, not for transfers under an adequacy decision like the EU-US Data Privacy Framework. Performing one here adds effort without creating the legal basis, and it is not the prerequisite action for using the framework.
- ✗
Execute a Binding Corporate Rules application with the lead supervisory authority in the EU member state where the subsidiary is established.
Why it's wrong here
Binding Corporate Rules are an alternative transfer tool for intra-group transfers, not for sending data to an unrelated external HR platform. They also require lengthy approval by the competent supervisory authority and are unnecessary when a valid adequacy-based framework already covers the importer. This step does not establish the DPF transfer mechanism.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.